diff --git a/auxil/bifcl b/auxil/bifcl
index 9c10bb74bb..10a4c00735 160000
--- a/auxil/bifcl
+++ b/auxil/bifcl
@@ -1 +1 @@
-Subproject commit 9c10bb74bb62aa7fb10efc079f1b2e5926e9798c
+Subproject commit 10a4c007351ab7d16e5cbef0006a5ad9002ea3de
diff --git a/src/Anon.cc b/src/Anon.cc
index bb878061ae..e2e1d73a54 100644
--- a/src/Anon.cc
+++ b/src/Anon.cc
@@ -358,9 +358,9 @@ AnonymizeIPAddr_A50::Node* AnonymizeIPAddr_A50::find_node(ipaddr32_t a)
 	return nullptr;
 	}
 
-static IntrusivePtr<TableVal> anon_preserve_orig_addr;
-static IntrusivePtr<TableVal> anon_preserve_resp_addr;
-static IntrusivePtr<TableVal> anon_preserve_other_addr;
+static zeek::IntrusivePtr<TableVal> anon_preserve_orig_addr;
+static zeek::IntrusivePtr<TableVal> anon_preserve_resp_addr;
+static zeek::IntrusivePtr<TableVal> anon_preserve_other_addr;
 
 void zeek::detail::init_ip_addr_anonymizers()
 	{
@@ -373,23 +373,23 @@ void zeek::detail::init_ip_addr_anonymizers()
 	auto id = global_scope()->Find("preserve_orig_addr");
 
 	if ( id )
-		anon_preserve_orig_addr = cast_intrusive<TableVal>(id->GetVal());
+		anon_preserve_orig_addr = zeek::cast_intrusive<TableVal>(id->GetVal());
 
 	id = global_scope()->Find("preserve_resp_addr");
 
 	if ( id )
-		anon_preserve_resp_addr = cast_intrusive<TableVal>(id->GetVal());
+		anon_preserve_resp_addr = zeek::cast_intrusive<TableVal>(id->GetVal());
 
 	id = global_scope()->Find("preserve_other_addr");
 
 	if ( id )
-		anon_preserve_other_addr = cast_intrusive<TableVal>(id->GetVal());
+		anon_preserve_other_addr = zeek::cast_intrusive<TableVal>(id->GetVal());
 	}
 
 ipaddr32_t zeek::detail::anonymize_ip(ipaddr32_t ip, enum ip_addr_anonymization_class_t cl)
 	{
 	TableVal* preserve_addr = nullptr;
-	auto addr = make_intrusive<AddrVal>(ip);
+	auto addr = zeek::make_intrusive<AddrVal>(ip);
 
 	int method = -1;
 
@@ -445,8 +445,8 @@ void zeek::detail::log_anonymization_mapping(ipaddr32_t input, ipaddr32_t output
 	{
 	if ( anonymization_mapping )
 		mgr.Enqueue(anonymization_mapping,
-			make_intrusive<AddrVal>(input),
-			make_intrusive<AddrVal>(output)
+			zeek::make_intrusive<AddrVal>(input),
+			zeek::make_intrusive<AddrVal>(output)
 		);
 	}
 
diff --git a/src/Attr.cc b/src/Attr.cc
index 61c1f0979b..a7a0717e18 100644
--- a/src/Attr.cc
+++ b/src/Attr.cc
@@ -25,7 +25,7 @@ const char* attr_name(AttrTag t)
 	return attr_names[int(t)];
 	}
 
-Attr::Attr(AttrTag t, IntrusivePtr<Expr> e)
+Attr::Attr(AttrTag t, zeek::IntrusivePtr<Expr> e)
 	: expr(std::move(e))
 	{
 	tag = t;
@@ -37,7 +37,7 @@ Attr::Attr(AttrTag t)
 	{
 	}
 
-void Attr::SetAttrExpr(IntrusivePtr<zeek::detail::Expr> e)
+void Attr::SetAttrExpr(zeek::IntrusivePtr<zeek::detail::Expr> e)
 	{ expr = std::move(e); }
 
 void Attr::Describe(ODesc* d) const
@@ -136,7 +136,7 @@ void Attr::AddTag(ODesc* d) const
 		d->Add(attr_name(Tag()));
 	}
 
-Attributes::Attributes(attr_list* a, IntrusivePtr<Type> t, bool arg_in_record, bool is_global)
+Attributes::Attributes(attr_list* a, zeek::IntrusivePtr<Type> t, bool arg_in_record, bool is_global)
 	{
 	attrs_list.resize(a->length());
 	attrs.reserve(a->length());
@@ -150,19 +150,19 @@ Attributes::Attributes(attr_list* a, IntrusivePtr<Type> t, bool arg_in_record, b
 	// the necessary checking gets done.
 
 	for ( const auto& attr : *a )
-		AddAttr({NewRef{}, attr});
+		AddAttr({zeek::NewRef{}, attr});
 
 	delete a;
 	}
 
-Attributes::Attributes(IntrusivePtr<Type> t,
+Attributes::Attributes(zeek::IntrusivePtr<Type> t,
                        bool arg_in_record, bool is_global)
-    : Attributes(std::vector<IntrusivePtr<Attr>>{}, std::move(t),
+    : Attributes(std::vector<zeek::IntrusivePtr<Attr>>{}, std::move(t),
                  arg_in_record, is_global)
     {}
 
-Attributes::Attributes(std::vector<IntrusivePtr<Attr>> a,
-                       IntrusivePtr<Type> t,
+Attributes::Attributes(std::vector<zeek::IntrusivePtr<Attr>> a,
+                       zeek::IntrusivePtr<Type> t,
                        bool arg_in_record, bool is_global)
 	: type(std::move(t))
 	{
@@ -181,7 +181,7 @@ Attributes::Attributes(std::vector<IntrusivePtr<Attr>> a,
 		AddAttr(std::move(attr));
 	}
 
-void Attributes::AddAttr(IntrusivePtr<Attr> attr)
+void Attributes::AddAttr(zeek::IntrusivePtr<Attr> attr)
 	{
 	// We overwrite old attributes by deleting them first.
 	RemoveAttr(attr->Tag());
@@ -197,7 +197,7 @@ void Attributes::AddAttr(IntrusivePtr<Attr> attr)
 	if ( (attr->Tag() == ATTR_ADD_FUNC || attr->Tag() == ATTR_DEL_FUNC) &&
 	     ! Find(ATTR_REDEF) )
 		{
-		auto a = make_intrusive<Attr>(ATTR_REDEF);
+		auto a = zeek::make_intrusive<Attr>(ATTR_REDEF);
 		attrs_list.push_back(a.get());
 		attrs.emplace_back(std::move(a));
 		}
@@ -206,13 +206,13 @@ void Attributes::AddAttr(IntrusivePtr<Attr> attr)
 	if ( ! global_var && attr->Tag() == ATTR_DEFAULT &&
 	     ! Find(ATTR_OPTIONAL) )
 		{
-		auto a = make_intrusive<Attr>(ATTR_OPTIONAL);
+		auto a = zeek::make_intrusive<Attr>(ATTR_OPTIONAL);
 		attrs_list.push_back(a.get());
 		attrs.emplace_back(std::move(a));
 		}
 	}
 
-void Attributes::AddAttrs(const IntrusivePtr<Attributes>& a)
+void Attributes::AddAttrs(const zeek::IntrusivePtr<Attributes>& a)
 	{
 	for ( const auto& attr : a->GetAttrs() )
 		AddAttr(attr);
@@ -235,7 +235,7 @@ Attr* Attributes::FindAttr(AttrTag t) const
 	return nullptr;
 	}
 
-const IntrusivePtr<Attr>& Attributes::Find(AttrTag t) const
+const zeek::IntrusivePtr<Attr>& Attributes::Find(AttrTag t) const
 	{
 	for ( const auto& a : attrs )
 		if ( a->Tag() == t )
diff --git a/src/Attr.h b/src/Attr.h
index db70a57b3d..671a428f98 100644
--- a/src/Attr.h
+++ b/src/Attr.h
@@ -40,9 +40,9 @@ enum AttrTag {
 
 class Attr final : public BroObj {
 public:
-	static inline const IntrusivePtr<zeek::detail::Attr> nil;
+	static inline const zeek::IntrusivePtr<zeek::detail::Attr> nil;
 
-	Attr(AttrTag t, IntrusivePtr<zeek::detail::Expr> e);
+	Attr(AttrTag t, zeek::IntrusivePtr<zeek::detail::Expr> e);
 	explicit Attr(AttrTag t);
 
 	~Attr() override = default;
@@ -52,10 +52,10 @@ public:
 	[[deprecated("Remove in v4.1.  Use GetExpr().")]]
 	zeek::detail::Expr* AttrExpr() const	{ return expr.get(); }
 
-	const IntrusivePtr<zeek::detail::Expr>& GetExpr() const
+	const zeek::IntrusivePtr<zeek::detail::Expr>& GetExpr() const
 		{ return expr; }
 
-	void SetAttrExpr(IntrusivePtr<zeek::detail::Expr> e);
+	void SetAttrExpr(zeek::IntrusivePtr<zeek::detail::Expr> e);
 
 	void Describe(ODesc* d) const override;
 	void DescribeReST(ODesc* d, bool shorten = false) const;
@@ -78,24 +78,24 @@ protected:
 	void AddTag(ODesc* d) const;
 
 	AttrTag tag;
-	IntrusivePtr<Expr> expr;
+	zeek::IntrusivePtr<Expr> expr;
 };
 
 // Manages a collection of attributes.
 class Attributes final : public BroObj {
 public:
 	[[deprecated("Remove in v4.1.  Construct using IntrusivePtrs instead.")]]
-	Attributes(attr_list* a, IntrusivePtr<Type> t, bool in_record, bool is_global);
+	Attributes(attr_list* a, zeek::IntrusivePtr<Type> t, bool in_record, bool is_global);
 
-	Attributes(std::vector<IntrusivePtr<Attr>> a, IntrusivePtr<Type> t,
+	Attributes(std::vector<zeek::IntrusivePtr<Attr>> a, zeek::IntrusivePtr<Type> t,
 	           bool in_record, bool is_global);
-	Attributes(IntrusivePtr<Type> t, bool in_record, bool is_global);
+	Attributes(zeek::IntrusivePtr<Type> t, bool in_record, bool is_global);
 
 	~Attributes() override = default;
 
-	void AddAttr(IntrusivePtr<Attr> a);
+	void AddAttr(zeek::IntrusivePtr<Attr> a);
 
-	void AddAttrs(const IntrusivePtr<Attributes>& a);
+	void AddAttrs(const zeek::IntrusivePtr<Attributes>& a);
 
 	[[deprecated("Remove in v4.1. Pass IntrusivePtr instead.")]]
 	void AddAttrs(Attributes* a);	// Unref's 'a' when done
@@ -103,7 +103,7 @@ public:
 	[[deprecated("Remove in v4.1. Use Find().")]]
 	Attr* FindAttr(AttrTag t) const;
 
-	const IntrusivePtr<Attr>& Find(AttrTag t) const;
+	const zeek::IntrusivePtr<Attr>& Find(AttrTag t) const;
 
 	void RemoveAttr(AttrTag t);
 
@@ -114,7 +114,7 @@ public:
 	const attr_list* Attrs() const
 		{ return &attrs_list; }
 
-	const std::vector<IntrusivePtr<Attr>>& GetAttrs() const
+	const std::vector<zeek::IntrusivePtr<Attr>>& GetAttrs() const
 		{ return attrs; }
 
 	bool operator==(const Attributes& other) const;
@@ -122,8 +122,8 @@ public:
 protected:
 	void CheckAttr(Attr* attr);
 
-	IntrusivePtr<Type> type;
-	std::vector<IntrusivePtr<Attr>> attrs;
+	zeek::IntrusivePtr<Type> type;
+	std::vector<zeek::IntrusivePtr<Attr>> attrs;
 
 	// Remove in v4.1. This is used by Attrs(), which is deprecated.
 	attr_list attrs_list;
diff --git a/src/BifReturnVal.cc b/src/BifReturnVal.cc
index 8a8444161b..5140e07035 100644
--- a/src/BifReturnVal.cc
+++ b/src/BifReturnVal.cc
@@ -7,5 +7,5 @@ BifReturnVal::BifReturnVal(std::nullptr_t) noexcept
 	{}
 
 BifReturnVal::BifReturnVal(Val* v) noexcept
-	: rval(AdoptRef{}, v)
+	: rval(zeek::AdoptRef{}, v)
 	{}
diff --git a/src/BifReturnVal.h b/src/BifReturnVal.h
index 2f6293cdf8..143aaf500d 100644
--- a/src/BifReturnVal.h
+++ b/src/BifReturnVal.h
@@ -15,8 +15,8 @@ class BifReturnVal {
 public:
 
 	template <typename T>
-	BifReturnVal(IntrusivePtr<T> v) noexcept
-		: rval(AdoptRef{}, v.release())
+	BifReturnVal(zeek::IntrusivePtr<T> v) noexcept
+		: rval(zeek::AdoptRef{}, v.release())
 		{ }
 
 	BifReturnVal(std::nullptr_t) noexcept;
@@ -24,5 +24,5 @@ public:
 	[[deprecated("Remove in v4.1.  Return an IntrusivePtr instead.")]]
 	BifReturnVal(Val* v) noexcept;
 
-	IntrusivePtr<Val> rval;
+	zeek::IntrusivePtr<Val> rval;
 };
diff --git a/src/BroString.cc b/src/BroString.cc
index 2cd5059cc8..0b72851510 100644
--- a/src/BroString.cc
+++ b/src/BroString.cc
@@ -340,13 +340,13 @@ BroString::Vec* BroString::Split(const BroString::IdxVec& indices) const
 
 VectorVal* BroString:: VecToPolicy(Vec* vec)
 	{
-	auto result = make_intrusive<VectorVal>(zeek::id::string_vec);
+	auto result = zeek::make_intrusive<VectorVal>(zeek::id::string_vec);
 
 	for ( unsigned int i = 0; i < vec->size(); ++i )
 		{
 		BroString* string = (*vec)[i];
-		auto val = make_intrusive<StringVal>(string->Len(),
-		                                     (const char*) string->Bytes());
+		auto val = zeek::make_intrusive<StringVal>(string->Len(),
+		                                           (const char*) string->Bytes());
 		result->Assign(i+1, std::move(val));
 		}
 
diff --git a/src/CompHash.cc b/src/CompHash.cc
index 0b08aafb5b..ca72584ea4 100644
--- a/src/CompHash.cc
+++ b/src/CompHash.cc
@@ -15,7 +15,7 @@
 #include "Func.h"
 #include "IPAddr.h"
 
-CompositeHash::CompositeHash(IntrusivePtr<zeek::TypeList> composite_type)
+CompositeHash::CompositeHash(zeek::IntrusivePtr<zeek::TypeList> composite_type)
 	: type(std::move(composite_type))
 	{
 	singleton_tag = zeek::TYPE_INTERNAL_ERROR;
@@ -209,7 +209,7 @@ char* CompositeHash::SingleValHash(bool type_check, char* kp0,
 
 			auto tbl = tv->AsTable();
 			auto it = tbl->InitForIteration();
-			auto lv = make_intrusive<ListVal>(zeek::TYPE_ANY);
+			auto lv = zeek::make_intrusive<ListVal>(zeek::TYPE_ANY);
 
 			struct HashKeyComparer {
 				bool operator()(const HashKey* a, const HashKey* b) const
@@ -351,7 +351,7 @@ std::unique_ptr<HashKey> CompositeHash::MakeHashKey(const Val& argv, bool type_c
 		// re-introduce const on the recursive call, it should
 		// be okay; the only thing is that the ListVal unref's it.
 		Val* ncv = (Val*) v;
-		lv.Append({NewRef{}, ncv});
+		lv.Append({zeek::NewRef{}, ncv});
 		return MakeHashKey(lv, type_check);
 		}
 
@@ -709,16 +709,16 @@ int CompositeHash::SizeAlign(int offset, unsigned int size) const
 	return offset;
 	}
 
-IntrusivePtr<ListVal> CompositeHash::RecoverVals(const HashKey& k) const
+zeek::IntrusivePtr<ListVal> CompositeHash::RecoverVals(const HashKey& k) const
 	{
-	auto l = make_intrusive<ListVal>(zeek::TYPE_ANY);
+	auto l = zeek::make_intrusive<ListVal>(zeek::TYPE_ANY);
 	const auto& tl = type->GetTypes();
 	const char* kp = (const char*) k.Key();
 	const char* const k_end = kp + k.Size();
 
 	for ( const auto& type : tl )
 		{
-		IntrusivePtr<Val> v;
+		zeek::IntrusivePtr<Val> v;
 		kp = RecoverOneVal(k, kp, k_end, type.get(), &v, false);
 		ASSERT(v);
 		l->Append(std::move(v));
@@ -730,9 +730,10 @@ IntrusivePtr<ListVal> CompositeHash::RecoverVals(const HashKey& k) const
 	return l;
 	}
 
-const char* CompositeHash::RecoverOneVal(const HashKey& k, const char* kp0,
-					 const char* const k_end, zeek::Type* t,
-					 IntrusivePtr<Val>* pval, bool optional) const
+const char* CompositeHash::RecoverOneVal(
+	const HashKey& k, const char* kp0,
+	const char* const k_end, zeek::Type* t,
+	zeek::IntrusivePtr<Val>* pval, bool optional) const
 	{
 	// k->Size() == 0 for a single empty string.
 	if ( kp0 >= k_end && k.Size() > 0 )
@@ -803,11 +804,11 @@ const char* CompositeHash::RecoverOneVal(const HashKey& k, const char* kp0,
 		kp1 = reinterpret_cast<const char*>(kp+1);
 
 		if ( tag == zeek::TYPE_INTERVAL )
-			*pval = make_intrusive<IntervalVal>(*kp, 1.0);
+			*pval = zeek::make_intrusive<IntervalVal>(*kp, 1.0);
 		else if ( tag == zeek::TYPE_TIME )
-			*pval = make_intrusive<TimeVal>(*kp);
+			*pval = zeek::make_intrusive<TimeVal>(*kp);
 		else
-			*pval = make_intrusive<DoubleVal>(*kp);
+			*pval = zeek::make_intrusive<DoubleVal>(*kp);
 		}
 		break;
 
@@ -820,7 +821,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey& k, const char* kp0,
 
 		switch ( tag ) {
 		case zeek::TYPE_ADDR:
-			*pval = make_intrusive<AddrVal>(addr);
+			*pval = zeek::make_intrusive<AddrVal>(addr);
 			break;
 
 		default:
@@ -835,7 +836,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey& k, const char* kp0,
 		{
 		const uint32_t* const kp = AlignType<uint32_t>(kp0);
 		kp1 = reinterpret_cast<const char*>(kp+5);
-		*pval = make_intrusive<SubNetVal>(kp, kp[4]);
+		*pval = zeek::make_intrusive<SubNetVal>(kp, kp[4]);
 		}
 		break;
 
@@ -853,7 +854,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey& k, const char* kp0,
 			if ( ! f )
 				reporter->InternalError("failed to look up unique function id %" PRIu32 " in CompositeHash::RecoverOneVal()", *kp);
 
-			*pval = make_intrusive<Val>(f);
+			*pval = zeek::make_intrusive<Val>(f);
 			const auto& pvt = (*pval)->GetType();
 
 			if ( ! pvt )
@@ -893,7 +894,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey& k, const char* kp0,
 				reporter->InternalError("failed compiling table/set key pattern: %s",
 				                        re->PatternText());
 
-			*pval = make_intrusive<PatternVal>(re);
+			*pval = zeek::make_intrusive<PatternVal>(re);
 			}
 			break;
 
@@ -903,11 +904,11 @@ const char* CompositeHash::RecoverOneVal(const HashKey& k, const char* kp0,
 			zeek::RecordType* rt = t->AsRecordType();
 			int num_fields = rt->NumFields();
 
-			std::vector<IntrusivePtr<Val>> values;
+			std::vector<zeek::IntrusivePtr<Val>> values;
 			int i;
 			for ( i = 0; i < num_fields; ++i )
 				{
-				IntrusivePtr<Val> v;
+				zeek::IntrusivePtr<Val> v;
 
 				zeek::detail::Attributes* a = rt->FieldDecl(i)->attrs.get();
 				bool optional = (a && a->Find(zeek::detail::ATTR_OPTIONAL));
@@ -930,7 +931,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey& k, const char* kp0,
 
 			ASSERT(int(values.size()) == num_fields);
 
-			auto rv = make_intrusive<RecordVal>(IntrusivePtr{NewRef{}, rt});
+			auto rv = zeek::make_intrusive<RecordVal>(zeek::IntrusivePtr{zeek::NewRef{}, rt});
 
 			for ( int i = 0; i < num_fields; ++i )
 				rv->Assign(i, std::move(values[i]));
@@ -947,18 +948,18 @@ const char* CompositeHash::RecoverOneVal(const HashKey& k, const char* kp0,
 			n = *kp;
 			kp1 = reinterpret_cast<const char*>(kp+1);
 			zeek::TableType* tt = t->AsTableType();
-			auto tv = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, tt});
+			auto tv = zeek::make_intrusive<TableVal>(zeek::IntrusivePtr{zeek::NewRef{}, tt});
 
 			for ( int i = 0; i < n; ++i )
 				{
-				IntrusivePtr<Val> key;
+				zeek::IntrusivePtr<Val> key;
 				kp1 = RecoverOneVal(k, kp1, k_end, tt->GetIndices().get(), &key, false);
 
 				if ( t->IsSet() )
 					tv->Assign(std::move(key), nullptr);
 				else
 					{
-					IntrusivePtr<Val> value;
+					zeek::IntrusivePtr<Val> value;
 					kp1 = RecoverOneVal(k, kp1, k_end, tt->Yield().get(), &value,
 					                    false);
 					tv->Assign(std::move(key), std::move(value));
@@ -976,7 +977,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey& k, const char* kp0,
 			n = *kp;
 			kp1 = reinterpret_cast<const char*>(kp+1);
 			zeek::VectorType* vt = t->AsVectorType();
-			auto vv = make_intrusive<VectorVal>(IntrusivePtr{NewRef{}, vt});
+			auto vv = zeek::make_intrusive<VectorVal>(zeek::IntrusivePtr{zeek::NewRef{}, vt});
 
 			for ( unsigned int i = 0; i < n; ++i )
 				{
@@ -986,7 +987,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey& k, const char* kp0,
 				kp = AlignType<unsigned int>(kp1);
 				unsigned int have_val = *kp;
 				kp1 = reinterpret_cast<const char*>(kp+1);
-				IntrusivePtr<Val> value;
+				zeek::IntrusivePtr<Val> value;
 
 				if ( have_val )
 					kp1 = RecoverOneVal(k, kp1, k_end, vt->Yield().get(), &value,
@@ -1006,11 +1007,11 @@ const char* CompositeHash::RecoverOneVal(const HashKey& k, const char* kp0,
 			n = *kp;
 			kp1 = reinterpret_cast<const char*>(kp+1);
 			zeek::TypeList* tl = t->AsTypeList();
-			auto lv = make_intrusive<ListVal>(zeek::TYPE_ANY);
+			auto lv = zeek::make_intrusive<ListVal>(zeek::TYPE_ANY);
 
 			for ( int i = 0; i < n; ++i )
 				{
-				IntrusivePtr<Val> v;
+				zeek::IntrusivePtr<Val> v;
 				zeek::Type* it = tl->GetTypes()[i].get();
 				kp1 = RecoverOneVal(k, kp1, k_end, it, &v, false);
 				lv->Append(std::move(v));
@@ -1046,7 +1047,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey& k, const char* kp0,
 			kp1 = reinterpret_cast<const char*>(kp+1);
 			}
 
-		*pval = make_intrusive<StringVal>(new BroString((const byte_vec) kp1, n, true));
+		*pval = zeek::make_intrusive<StringVal>(new BroString((const byte_vec) kp1, n, true));
 		kp1 += n;
 		}
 		break;
diff --git a/src/CompHash.h b/src/CompHash.h
index 367fd445a0..c900366680 100644
--- a/src/CompHash.h
+++ b/src/CompHash.h
@@ -12,7 +12,7 @@ class HashKey;
 
 class CompositeHash {
 public:
-	explicit CompositeHash(IntrusivePtr<zeek::TypeList> composite_type);
+	explicit CompositeHash(zeek::IntrusivePtr<zeek::TypeList> composite_type);
 	~CompositeHash();
 
 	// Compute the hash corresponding to the given index val,
@@ -24,10 +24,10 @@ public:
 		{ return MakeHashKey(*v, type_check).release(); }
 
 	// Given a hash key, recover the values used to create it.
-	IntrusivePtr<ListVal> RecoverVals(const HashKey& k) const;
+	zeek::IntrusivePtr<ListVal> RecoverVals(const HashKey& k) const;
 
 	[[deprecated("Remove in v4.1.  Pass in HashKey& instead.")]]
-	IntrusivePtr<ListVal> RecoverVals(const HashKey* k) const
+	zeek::IntrusivePtr<ListVal> RecoverVals(const HashKey* k) const
 		{ return RecoverVals(*k); }
 
 	unsigned int MemoryAllocation() const { return padded_sizeof(*this) + pad_size(size); }
@@ -38,15 +38,15 @@ protected:
 	// Computes the piece of the hash for Val*, returning the new kp.
 	// Used as a helper for ComputeHash in the non-singleton case.
 	char* SingleValHash(bool type_check, char* kp, zeek::Type* bt, Val* v,
-			    bool optional) const;
+	                    bool optional) const;
 
 	// Recovers just one Val of possibly many; called from RecoverVals.
 	// Upon return, pval will point to the recovered Val of type t.
 	// Returns and updated kp for the next Val.  Calls reporter->InternalError()
 	// upon errors, so there is no return value for invalid input.
-	const char* RecoverOneVal(const HashKey& k,
-				  const char* kp, const char* const k_end,
-				  zeek::Type* t, IntrusivePtr<Val>* pval, bool optional) const;
+	const char* RecoverOneVal(
+		const HashKey& k, const char* kp, const char* const k_end,
+		zeek::Type* t, zeek::IntrusivePtr<Val>* pval, bool optional) const;
 
 	// Rounds the given pointer up to the nearest multiple of the
 	// given size, if not already a multiple.
@@ -89,7 +89,7 @@ protected:
 			      bool type_check, int sz, bool optional,
 			      bool calc_static_size) const;
 
-	IntrusivePtr<zeek::TypeList> type;
+	zeek::IntrusivePtr<zeek::TypeList> type;
 	char* key;	// space for composite key
 	int size;
 	bool is_singleton;	// if just one type in index
diff --git a/src/Conn.cc b/src/Conn.cc
index f934a025de..81d6667300 100644
--- a/src/Conn.cc
+++ b/src/Conn.cc
@@ -342,21 +342,21 @@ RecordVal* Connection::BuildConnVal()
 	return ConnVal()->Ref()->AsRecordVal();
 	}
 
-const IntrusivePtr<RecordVal>& Connection::ConnVal()
+const zeek::IntrusivePtr<RecordVal>& Connection::ConnVal()
 	{
 	if ( ! conn_val )
 		{
-		conn_val = make_intrusive<RecordVal>(zeek::id::connection);
+		conn_val = zeek::make_intrusive<RecordVal>(zeek::id::connection);
 
 		TransportProto prot_type = ConnTransport();
 
-		auto id_val = make_intrusive<RecordVal>(zeek::id::conn_id);
-		id_val->Assign(0, make_intrusive<AddrVal>(orig_addr));
+		auto id_val = zeek::make_intrusive<RecordVal>(zeek::id::conn_id);
+		id_val->Assign(0, zeek::make_intrusive<AddrVal>(orig_addr));
 		id_val->Assign(1, val_mgr->Port(ntohs(orig_port), prot_type));
-		id_val->Assign(2, make_intrusive<AddrVal>(resp_addr));
+		id_val->Assign(2, zeek::make_intrusive<AddrVal>(resp_addr));
 		id_val->Assign(3, val_mgr->Port(ntohs(resp_port), prot_type));
 
-		auto orig_endp = make_intrusive<RecordVal>(zeek::id::endpoint);
+		auto orig_endp = zeek::make_intrusive<RecordVal>(zeek::id::endpoint);
 		orig_endp->Assign(0, val_mgr->Count(0));
 		orig_endp->Assign(1, val_mgr->Count(0));
 		orig_endp->Assign(4, val_mgr->Count(orig_flow_label));
@@ -365,27 +365,27 @@ const IntrusivePtr<RecordVal>& Connection::ConnVal()
 		char null[l2_len]{};
 
 		if ( memcmp(&orig_l2_addr, &null, l2_len) != 0 )
-			orig_endp->Assign(5, make_intrusive<StringVal>(fmt_mac(orig_l2_addr, l2_len)));
+			orig_endp->Assign(5, zeek::make_intrusive<StringVal>(fmt_mac(orig_l2_addr, l2_len)));
 
-		auto resp_endp = make_intrusive<RecordVal>(zeek::id::endpoint);
+		auto resp_endp = zeek::make_intrusive<RecordVal>(zeek::id::endpoint);
 		resp_endp->Assign(0, val_mgr->Count(0));
 		resp_endp->Assign(1, val_mgr->Count(0));
 		resp_endp->Assign(4, val_mgr->Count(resp_flow_label));
 
 		if ( memcmp(&resp_l2_addr, &null, l2_len) != 0 )
-			resp_endp->Assign(5, make_intrusive<StringVal>(fmt_mac(resp_l2_addr, l2_len)));
+			resp_endp->Assign(5, zeek::make_intrusive<StringVal>(fmt_mac(resp_l2_addr, l2_len)));
 
 		conn_val->Assign(0, std::move(id_val));
 		conn_val->Assign(1, std::move(orig_endp));
 		conn_val->Assign(2, std::move(resp_endp));
 		// 3 and 4 are set below.
-		conn_val->Assign(5, make_intrusive<TableVal>(zeek::id::string_set));	// service
+		conn_val->Assign(5, zeek::make_intrusive<TableVal>(zeek::id::string_set));	// service
 		conn_val->Assign(6, val_mgr->EmptyString());	// history
 
 		if ( ! uid )
 			uid.Set(bits_per_uid);
 
-		conn_val->Assign(7, make_intrusive<StringVal>(uid.Base62("C").c_str()));
+		conn_val->Assign(7, zeek::make_intrusive<StringVal>(uid.Base62("C").c_str()));
 
 		if ( encapsulation && encapsulation->Depth() > 0 )
 			conn_val->Assign(8, encapsulation->ToVal());
@@ -401,9 +401,9 @@ const IntrusivePtr<RecordVal>& Connection::ConnVal()
 	if ( root_analyzer )
 		root_analyzer->UpdateConnVal(conn_val.get());
 
-	conn_val->Assign(3, make_intrusive<TimeVal>(start_time));	// ###
-	conn_val->Assign(4, make_intrusive<IntervalVal>(last_time - start_time));
-	conn_val->Assign(6, make_intrusive<StringVal>(history.c_str()));
+	conn_val->Assign(3, zeek::make_intrusive<TimeVal>(start_time));	// ###
+	conn_val->Assign(4, zeek::make_intrusive<IntervalVal>(last_time - start_time));
+	conn_val->Assign(6, zeek::make_intrusive<StringVal>(history.c_str()));
 	conn_val->Assign(11, val_mgr->Bool(is_successful));
 
 	conn_val->SetOrigin(this);
@@ -433,7 +433,7 @@ void Connection::AppendAddl(const char* str)
 	const char* old = cv->GetField(6)->AsString()->CheckString();
 	const char* format = *old ? "%s %s" : "%s%s";
 
-	cv->Assign(6, make_intrusive<StringVal>(fmt(format, old, str)));
+	cv->Assign(6, zeek::make_intrusive<StringVal>(fmt(format, old, str)));
 	}
 
 // Returns true if the character at s separates a version number.
@@ -470,7 +470,7 @@ void Connection::Event(EventHandlerPtr f, analyzer::Analyzer* analyzer, const ch
 		return;
 
 	if ( name )
-		EnqueueEvent(f, analyzer, make_intrusive<StringVal>(name), ConnVal());
+		EnqueueEvent(f, analyzer, zeek::make_intrusive<StringVal>(name), ConnVal());
 	else
 		EnqueueEvent(f, analyzer, ConnVal());
 	}
@@ -487,12 +487,12 @@ void Connection::Event(EventHandlerPtr f, analyzer::Analyzer* analyzer, Val* v1,
 	if ( v2 )
 		EnqueueEvent(f, analyzer,
 		             ConnVal(),
-		             IntrusivePtr{AdoptRef{}, v1},
-		             IntrusivePtr{AdoptRef{}, v2});
+		             zeek::IntrusivePtr{zeek::AdoptRef{}, v1},
+		             zeek::IntrusivePtr{zeek::AdoptRef{}, v2});
 	else
 		EnqueueEvent(f, analyzer,
 		             ConnVal(),
-		             IntrusivePtr{AdoptRef{}, v1});
+		             zeek::IntrusivePtr{zeek::AdoptRef{}, v1});
 	}
 
 void Connection::ConnectionEvent(EventHandlerPtr f, analyzer::Analyzer* a, val_list vl)
diff --git a/src/Conn.h b/src/Conn.h
index 161bb6b759..0297eb8310 100644
--- a/src/Conn.h
+++ b/src/Conn.h
@@ -169,7 +169,7 @@ public:
 	/**
 	 * Returns the associated "connection" record.
 	 */
-	const IntrusivePtr<RecordVal>& ConnVal();
+	const zeek::IntrusivePtr<RecordVal>& ConnVal();
 
 	void AppendAddl(const char* str);
 
@@ -235,7 +235,7 @@ public:
 	template <class... Args>
 	std::enable_if_t<
 	  std::is_convertible_v<
-	    std::tuple_element_t<0, std::tuple<Args...>>, IntrusivePtr<Val>>>
+	    std::tuple_element_t<0, std::tuple<Args...>>, zeek::IntrusivePtr<Val>>>
 	EnqueueEvent(EventHandlerPtr h, analyzer::Analyzer* analyzer, Args&&... args)
 		{ return EnqueueEvent(h, analyzer, zeek::Args{std::forward<Args>(args)...}); }
 
@@ -355,7 +355,7 @@ protected:
 	u_char resp_l2_addr[Packet::l2_addr_len];	// Link-layer responder address, if available
 	double start_time, last_time;
 	double inactivity_timeout;
-	IntrusivePtr<RecordVal> conn_val;
+	zeek::IntrusivePtr<RecordVal> conn_val;
 	LoginConn* login_conn;	// either nil, or this
 	const EncapsulationStack* encapsulation; // tunnels
 	int suppress_event;	// suppress certain events to once per conn.
diff --git a/src/DNS_Mgr.cc b/src/DNS_Mgr.cc
index 346fc348b7..2c714a72d5 100644
--- a/src/DNS_Mgr.cc
+++ b/src/DNS_Mgr.cc
@@ -122,9 +122,9 @@ public:
 		return req_host ? req_host : req_addr.AsString();
 		}
 
-	IntrusivePtr<ListVal> Addrs();
-	IntrusivePtr<TableVal> AddrsSet();	// addresses returned as a set
-	IntrusivePtr<StringVal> Host();
+	zeek::IntrusivePtr<ListVal> Addrs();
+	zeek::IntrusivePtr<TableVal> AddrsSet();	// addresses returned as a set
+	zeek::IntrusivePtr<StringVal> Host();
 
 	double CreationTime() const	{ return creation_time; }
 
@@ -155,11 +155,11 @@ protected:
 
 	int num_names;
 	char** names;
-	IntrusivePtr<StringVal> host_val;
+	zeek::IntrusivePtr<StringVal> host_val;
 
 	int num_addrs;
 	IPAddr* addrs;
-	IntrusivePtr<ListVal> addrs_val;
+	zeek::IntrusivePtr<ListVal> addrs_val;
 
 	double creation_time;
 	int map_type;
@@ -173,13 +173,13 @@ void DNS_Mgr_mapping_delete_func(void* v)
 	delete (DNS_Mapping*) v;
 	}
 
-static IntrusivePtr<TableVal> empty_addr_set()
+static zeek::IntrusivePtr<TableVal> empty_addr_set()
 	{
 	auto addr_t = zeek::base_type(zeek::TYPE_ADDR);
-	auto set_index = make_intrusive<zeek::TypeList>(addr_t);
+	auto set_index = zeek::make_intrusive<zeek::TypeList>(addr_t);
 	set_index->Append(std::move(addr_t));
-	auto s = make_intrusive<zeek::SetType>(std::move(set_index), nullptr);
-	return make_intrusive<TableVal>(std::move(s));
+	auto s = zeek::make_intrusive<zeek::SetType>(std::move(set_index), nullptr);
+	return zeek::make_intrusive<TableVal>(std::move(s));
 	}
 
 DNS_Mapping::DNS_Mapping(const char* host, struct hostent* h, uint32_t ttl)
@@ -276,23 +276,23 @@ DNS_Mapping::~DNS_Mapping()
 	delete [] addrs;
 	}
 
-IntrusivePtr<ListVal> DNS_Mapping::Addrs()
+zeek::IntrusivePtr<ListVal> DNS_Mapping::Addrs()
 	{
 	if ( failed )
 		return nullptr;
 
 	if ( ! addrs_val )
 		{
-		addrs_val = make_intrusive<ListVal>(zeek::TYPE_ADDR);
+		addrs_val = zeek::make_intrusive<ListVal>(zeek::TYPE_ADDR);
 
 		for ( int i = 0; i < num_addrs; ++i )
-			addrs_val->Append(make_intrusive<AddrVal>(addrs[i]));
+			addrs_val->Append(zeek::make_intrusive<AddrVal>(addrs[i]));
 		}
 
 	return addrs_val;
 	}
 
-IntrusivePtr<TableVal> DNS_Mapping::AddrsSet() {
+zeek::IntrusivePtr<TableVal> DNS_Mapping::AddrsSet() {
 	auto l = Addrs();
 
 	if ( ! l )
@@ -301,13 +301,13 @@ IntrusivePtr<TableVal> DNS_Mapping::AddrsSet() {
 	return l->ToSetVal();
 	}
 
-IntrusivePtr<StringVal> DNS_Mapping::Host()
+zeek::IntrusivePtr<StringVal> DNS_Mapping::Host()
 	{
 	if ( failed || num_names == 0 || ! names[0] )
 		return nullptr;
 
 	if ( ! host_val )
-		host_val = make_intrusive<StringVal>(names[0]);
+		host_val = zeek::make_intrusive<StringVal>(names[0]);
 
 	return host_val;
 	}
@@ -461,12 +461,12 @@ void DNS_Mgr::InitPostScript()
 	LoadCache(fopen(cache_name, "r"));
 	}
 
-static IntrusivePtr<TableVal> fake_name_lookup_result(const char* name)
+static zeek::IntrusivePtr<TableVal> fake_name_lookup_result(const char* name)
 	{
 	hash128_t hash;
 	KeyedHash::StaticHash128(name, strlen(name), &hash);
-	auto hv = make_intrusive<ListVal>(zeek::TYPE_ADDR);
-	hv->Append(make_intrusive<AddrVal>(reinterpret_cast<const uint32_t*>(&hash)));
+	auto hv = zeek::make_intrusive<ListVal>(zeek::TYPE_ADDR);
+	hv->Append(zeek::make_intrusive<AddrVal>(reinterpret_cast<const uint32_t*>(&hash)));
 	return hv->ToSetVal();
 	}
 
@@ -485,7 +485,7 @@ static const char* fake_addr_lookup_result(const IPAddr& addr)
 	return tmp;
 	}
 
-IntrusivePtr<TableVal> DNS_Mgr::LookupHost(const char* name)
+zeek::IntrusivePtr<TableVal> DNS_Mgr::LookupHost(const char* name)
 	{
 	if ( mode == DNS_FAKE )
 		return fake_name_lookup_result(name);
@@ -542,7 +542,7 @@ IntrusivePtr<TableVal> DNS_Mgr::LookupHost(const char* name)
 	}
 	}
 
-IntrusivePtr<Val> DNS_Mgr::LookupAddr(const IPAddr& addr)
+zeek::IntrusivePtr<Val> DNS_Mgr::LookupAddr(const IPAddr& addr)
 	{
 	InitSource();
 
@@ -559,7 +559,7 @@ IntrusivePtr<Val> DNS_Mgr::LookupAddr(const IPAddr& addr)
 				{
 				string s(addr);
 				reporter->Warning("can't resolve IP address: %s", s.c_str());
-				return make_intrusive<StringVal>(s.c_str());
+				return zeek::make_intrusive<StringVal>(s.c_str());
 				}
 			}
 		}
@@ -568,7 +568,7 @@ IntrusivePtr<Val> DNS_Mgr::LookupAddr(const IPAddr& addr)
 	switch ( mode ) {
 	case DNS_PRIME:
 		requests.push_back(new DNS_Mgr_Request(addr));
-		return make_intrusive<StringVal>("<none>");
+		return zeek::make_intrusive<StringVal>("<none>");
 
 	case DNS_FORCE:
 		reporter->FatalError("can't find DNS entry for %s in cache",
@@ -698,7 +698,7 @@ void DNS_Mgr::Event(EventHandlerPtr e, DNS_Mapping* dm)
 	}
 
 void DNS_Mgr::Event(EventHandlerPtr e, DNS_Mapping* dm,
-					IntrusivePtr<ListVal> l1, IntrusivePtr<ListVal> l2)
+					zeek::IntrusivePtr<ListVal> l1, zeek::IntrusivePtr<ListVal> l2)
 	{
 	if ( ! e )
 		return;
@@ -714,17 +714,17 @@ void DNS_Mgr::Event(EventHandlerPtr e, DNS_Mapping* old_dm, DNS_Mapping* new_dm)
 	mgr.Enqueue(e, BuildMappingVal(old_dm), BuildMappingVal(new_dm));
 	}
 
-IntrusivePtr<Val> DNS_Mgr::BuildMappingVal(DNS_Mapping* dm)
+zeek::IntrusivePtr<Val> DNS_Mgr::BuildMappingVal(DNS_Mapping* dm)
 	{
-	auto r = make_intrusive<RecordVal>(dm_rec);
+	auto r = zeek::make_intrusive<RecordVal>(dm_rec);
 
-	r->Assign(0, make_intrusive<TimeVal>(dm->CreationTime()));
-	r->Assign(1, make_intrusive<StringVal>(dm->ReqHost() ? dm->ReqHost() : ""));
-	r->Assign(2, make_intrusive<AddrVal>(dm->ReqAddr()));
+	r->Assign(0, zeek::make_intrusive<TimeVal>(dm->CreationTime()));
+	r->Assign(1, zeek::make_intrusive<StringVal>(dm->ReqHost() ? dm->ReqHost() : ""));
+	r->Assign(2, zeek::make_intrusive<AddrVal>(dm->ReqAddr()));
 	r->Assign(3, val_mgr->Bool(dm->Valid()));
 
 	auto h = dm->Host();
-	r->Assign(4, h ? std::move(h) : make_intrusive<StringVal>("<none>"));
+	r->Assign(4, h ? std::move(h) : zeek::make_intrusive<StringVal>("<none>"));
 	r->Assign(5, dm->AddrsSet());
 
 	return r;
@@ -870,9 +870,9 @@ void DNS_Mgr::CompareMappings(DNS_Mapping* prev_dm, DNS_Mapping* new_dm)
 		Event(dns_mapping_altered, new_dm, std::move(prev_delta), std::move(new_delta));
 	}
 
-IntrusivePtr<ListVal> DNS_Mgr::AddrListDelta(ListVal* al1, ListVal* al2)
+zeek::IntrusivePtr<ListVal> DNS_Mgr::AddrListDelta(ListVal* al1, ListVal* al2)
 	{
-	auto delta = make_intrusive<ListVal>(zeek::TYPE_ADDR);
+	auto delta = zeek::make_intrusive<ListVal>(zeek::TYPE_ADDR);
 
 	for ( int i = 0; i < al1->Length(); ++i )
 		{
@@ -980,7 +980,7 @@ const char* DNS_Mgr::LookupAddrInCache(const IPAddr& addr)
 	return d->names ? d->names[0] : "<\?\?\?>";
 	}
 
-IntrusivePtr<TableVal> DNS_Mgr::LookupNameInCache(const string& name)
+zeek::IntrusivePtr<TableVal> DNS_Mgr::LookupNameInCache(const string& name)
 	{
 	HostMap::iterator it = host_mappings.find(name);
 	if ( it == host_mappings.end() )
@@ -1030,7 +1030,7 @@ const char* DNS_Mgr::LookupTextInCache(const string& name)
 	}
 
 static void resolve_lookup_cb(DNS_Mgr::LookupCallback* callback,
-                              IntrusivePtr<TableVal> result)
+                              zeek::IntrusivePtr<TableVal> result)
 	{
 	callback->Resolved(result.get());
 	delete callback;
diff --git a/src/DNS_Mgr.h b/src/DNS_Mgr.h
index 4e5079c585..55696900ae 100644
--- a/src/DNS_Mgr.h
+++ b/src/DNS_Mgr.h
@@ -50,9 +50,9 @@ public:
 
 	// Looks up the address or addresses of the given host, and returns
 	// a set of addr.
-	IntrusivePtr<TableVal> LookupHost(const char* host);
+	zeek::IntrusivePtr<TableVal> LookupHost(const char* host);
 
-	IntrusivePtr<Val> LookupAddr(const IPAddr& addr);
+	zeek::IntrusivePtr<Val> LookupAddr(const IPAddr& addr);
 
 	// Define the directory where to store the data.
 	void SetDir(const char* arg_dir)	{ dir = copy_string(arg_dir); }
@@ -62,7 +62,7 @@ public:
 	bool Save();
 
 	const char* LookupAddrInCache(const IPAddr& addr);
-	IntrusivePtr<TableVal> LookupNameInCache(const std::string& name);
+	zeek::IntrusivePtr<TableVal> LookupNameInCache(const std::string& name);
 	const char* LookupTextInCache(const std::string& name);
 
 	// Support for async lookups.
@@ -100,14 +100,14 @@ protected:
 
 	void Event(EventHandlerPtr e, DNS_Mapping* dm);
 	void Event(EventHandlerPtr e, DNS_Mapping* dm,
-	           IntrusivePtr<ListVal> l1, IntrusivePtr<ListVal> l2);
+	           zeek::IntrusivePtr<ListVal> l1, zeek::IntrusivePtr<ListVal> l2);
 	void Event(EventHandlerPtr e, DNS_Mapping* old_dm, DNS_Mapping* new_dm);
 
-	IntrusivePtr<Val> BuildMappingVal(DNS_Mapping* dm);
+	zeek::IntrusivePtr<Val> BuildMappingVal(DNS_Mapping* dm);
 
 	void AddResult(DNS_Mgr_Request* dr, struct nb_dns_result* r);
 	void CompareMappings(DNS_Mapping* prev_dm, DNS_Mapping* new_dm);
-	IntrusivePtr<ListVal> AddrListDelta(ListVal* al1, ListVal* al2);
+	zeek::IntrusivePtr<ListVal> AddrListDelta(ListVal* al1, ListVal* al2);
 	void DumpAddrList(FILE* f, ListVal* al);
 
 	typedef std::map<std::string, std::pair<DNS_Mapping*, DNS_Mapping*> > HostMap;
@@ -151,7 +151,7 @@ protected:
 
 	bool did_init;
 
-	IntrusivePtr<zeek::RecordType> dm_rec;
+	zeek::IntrusivePtr<zeek::RecordType> dm_rec;
 
 	typedef std::list<LookupCallback*> CallbackList;
 
diff --git a/src/DbgBreakpoint.cc b/src/DbgBreakpoint.cc
index 472924aba4..872a9dd5f5 100644
--- a/src/DbgBreakpoint.cc
+++ b/src/DbgBreakpoint.cc
@@ -13,7 +13,6 @@
 #include "Scope.h"
 #include "Frame.h"
 #include "Func.h"
-#include "IntrusivePtr.h"
 #include "Val.h"
 #include "Stmt.h"
 #include "Timer.h"
diff --git a/src/Debug.cc b/src/Debug.cc
index f1e94e96c9..6d81564617 100644
--- a/src/Debug.cc
+++ b/src/Debug.cc
@@ -948,7 +948,7 @@ extern YYLTYPE yylloc;	// holds start line and column of token
 extern int line_number;
 extern const char* filename;
 
-IntrusivePtr<Val> dbg_eval_expr(const char* expr)
+zeek::IntrusivePtr<Val> dbg_eval_expr(const char* expr)
 	{
 	// Push the current frame's associated scope.
 	// Note: g_debugger_state.curr_frame_idx is the user-visible number,
@@ -983,7 +983,7 @@ IntrusivePtr<Val> dbg_eval_expr(const char* expr)
 	yylloc.first_line = yylloc.last_line = line_number = 1;
 
 	// Parse the thing into an expr.
-	IntrusivePtr<Val> result;
+	zeek::IntrusivePtr<Val> result;
 	if ( yyparse() )
 		{
 		if ( g_curr_debug_error )
diff --git a/src/Debug.h b/src/Debug.h
index e467c00a0e..bcd743fc2d 100644
--- a/src/Debug.h
+++ b/src/Debug.h
@@ -11,7 +11,10 @@
 #include <map>
 #include <string>
 
+namespace zeek {
 template <class T> class IntrusivePtr;
+}
+
 class Val;
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Stmt, zeek::detail);
@@ -162,7 +165,7 @@ int dbg_handle_debug_input();	// read a line and then have it executed
 int dbg_execute_command(const char* cmd);
 
 // Interactive expression evaluation.
-IntrusivePtr<Val> dbg_eval_expr(const char* expr);
+zeek::IntrusivePtr<Val> dbg_eval_expr(const char* expr);
 
 // Extra debugging facilities.
 // TODO: current connections, memory allocated, other internal data structures.
diff --git a/src/DebugCmds.cc b/src/DebugCmds.cc
index b7c411989a..abdba92675 100644
--- a/src/DebugCmds.cc
+++ b/src/DebugCmds.cc
@@ -15,7 +15,6 @@
 #include "Desc.h"
 #include "DbgBreakpoint.h"
 #include "ID.h"
-#include "IntrusivePtr.h"
 #include "Frame.h"
 #include "Func.h"
 #include "Stmt.h"
diff --git a/src/Discard.cc b/src/Discard.cc
index 6625786e3b..604205f982 100644
--- a/src/Discard.cc
+++ b/src/Discard.cc
@@ -93,7 +93,7 @@ bool Discarder::NextPacket(const IP_Hdr* ip, int len, int caplen)
 
 			zeek::Args args{
 				ip->ToPktHdrVal(),
-				{AdoptRef{}, BuildData(data, th_len, len, caplen)},
+				{zeek::AdoptRef{}, BuildData(data, th_len, len, caplen)},
 			};
 
 			try
@@ -117,7 +117,7 @@ bool Discarder::NextPacket(const IP_Hdr* ip, int len, int caplen)
 
 			zeek::Args args{
 				ip->ToPktHdrVal(),
-				{AdoptRef{}, BuildData(data, uh_len, len, caplen)},
+				{zeek::AdoptRef{}, BuildData(data, uh_len, len, caplen)},
 			};
 
 			try
diff --git a/src/Discard.h b/src/Discard.h
index ac69db845f..d04ee2dcd8 100644
--- a/src/Discard.h
+++ b/src/Discard.h
@@ -22,10 +22,10 @@ public:
 protected:
 	Val* BuildData(const u_char* data, int hdrlen, int len, int caplen);
 
-	IntrusivePtr<Func> check_ip;
-	IntrusivePtr<Func> check_tcp;
-	IntrusivePtr<Func> check_udp;
-	IntrusivePtr<Func> check_icmp;
+	zeek::IntrusivePtr<Func> check_ip;
+	zeek::IntrusivePtr<Func> check_tcp;
+	zeek::IntrusivePtr<Func> check_udp;
+	zeek::IntrusivePtr<Func> check_icmp;
 
 	// Maximum amount of application data passed to filtering functions.
 	int discarder_maxlen;
diff --git a/src/Event.h b/src/Event.h
index 69e9fe37f9..75ff3450a0 100644
--- a/src/Event.h
+++ b/src/Event.h
@@ -108,7 +108,7 @@ public:
 	template <class... Args>
 	std::enable_if_t<
 	  std::is_convertible_v<
-	    std::tuple_element_t<0, std::tuple<Args...>>, IntrusivePtr<Val>>>
+	    std::tuple_element_t<0, std::tuple<Args...>>, zeek::IntrusivePtr<Val>>>
 	Enqueue(const EventHandlerPtr& h, Args&&... args)
 		{ return Enqueue(h, zeek::Args{std::forward<Args>(args)...}); }
 
diff --git a/src/EventHandler.cc b/src/EventHandler.cc
index 60ae89536f..d73dc1fdd1 100644
--- a/src/EventHandler.cc
+++ b/src/EventHandler.cc
@@ -26,7 +26,7 @@ EventHandler::operator bool() const
 			   || ! auto_publish.empty());
 	}
 
-const IntrusivePtr<zeek::FuncType>& EventHandler::GetType(bool check_export)
+const zeek::IntrusivePtr<zeek::FuncType>& EventHandler::GetType(bool check_export)
 	{
 	if ( type )
 		return type;
@@ -44,11 +44,11 @@ const IntrusivePtr<zeek::FuncType>& EventHandler::GetType(bool check_export)
 	return type;
 	}
 
-void EventHandler::SetFunc(IntrusivePtr<Func> f)
+void EventHandler::SetFunc(zeek::IntrusivePtr<Func> f)
 	{ local = std::move(f); }
 
 void EventHandler::SetLocalHandler(Func* f)
-	{ SetFunc({NewRef{}, f}); }
+	{ SetFunc({zeek::NewRef{}, f}); }
 
 void EventHandler::Call(zeek::Args* vl, bool no_remote)
 	{
@@ -118,7 +118,7 @@ void EventHandler::NewEvent(zeek::Args* vl)
 
 	const auto& args = GetType()->Params();
 	static auto call_argument_vector = zeek::id::find_type<zeek::VectorType>("call_argument_vector");
-	auto vargs = make_intrusive<VectorVal>(call_argument_vector);
+	auto vargs = zeek::make_intrusive<VectorVal>(call_argument_vector);
 
 	for ( int i = 0; i < args->NumFields(); i++ )
 		{
@@ -127,13 +127,13 @@ void EventHandler::NewEvent(zeek::Args* vl)
 		auto fdefault = args->FieldDefault(i);
 
 		static auto call_argument = zeek::id::find_type<zeek::RecordType>("call_argument");
-		auto rec = make_intrusive<RecordVal>(call_argument);
-		rec->Assign(0, make_intrusive<StringVal>(fname));
+		auto rec = zeek::make_intrusive<RecordVal>(call_argument);
+		rec->Assign(0, zeek::make_intrusive<StringVal>(fname));
 
 		ODesc d;
 		d.SetShort();
 		ftype->Describe(&d);
-		rec->Assign(1, make_intrusive<StringVal>(d.Description()));
+		rec->Assign(1, zeek::make_intrusive<StringVal>(d.Description()));
 
 		if ( fdefault )
 			rec->Assign(2, std::move(fdefault));
@@ -145,7 +145,7 @@ void EventHandler::NewEvent(zeek::Args* vl)
 		}
 
 	Event* ev = new Event(new_event, {
-		make_intrusive<StringVal>(name),
+		zeek::make_intrusive<StringVal>(name),
 		std::move(vargs),
 	});
 	mgr.Dispatch(ev);
diff --git a/src/EventHandler.h b/src/EventHandler.h
index 4016328655..746522f53f 100644
--- a/src/EventHandler.h
+++ b/src/EventHandler.h
@@ -17,19 +17,19 @@ public:
 
 	const char* Name()	{ return name.data(); }
 
-	const IntrusivePtr<Func>& GetFunc()
+	const zeek::IntrusivePtr<Func>& GetFunc()
 		{ return local; }
 
 	[[deprecated("Remove in v4.1.  Use GetFunc().")]]
 	Func* LocalHandler()	{ return local.get(); }
 
-	const IntrusivePtr<zeek::FuncType>& GetType(bool check_export = true);
+	const zeek::IntrusivePtr<zeek::FuncType>& GetType(bool check_export = true);
 
 	[[deprecated("Remove in v4.1.  Use GetType().")]]
 	zeek::FuncType* FType(bool check_export = true)
 		{ return GetType().get(); }
 
-	void SetFunc(IntrusivePtr<Func> f);
+	void SetFunc(zeek::IntrusivePtr<Func> f);
 
 	[[deprecated("Remove in v4.1.  Use SetFunc().")]]
 	void SetLocalHandler(Func* f);
@@ -68,8 +68,8 @@ private:
 	void NewEvent(zeek::Args* vl);	// Raise new_event() meta event.
 
 	std::string name;
-	IntrusivePtr<Func> local;
-	IntrusivePtr<zeek::FuncType> type;
+	zeek::IntrusivePtr<Func> local;
+	zeek::IntrusivePtr<zeek::FuncType> type;
 	bool used;		// this handler is indeed used somewhere
 	bool enabled;
 	bool error_handler;	// this handler reports error messages.
diff --git a/src/Expr.cc b/src/Expr.cc
index 4d92224d64..12f0c639e2 100644
--- a/src/Expr.cc
+++ b/src/Expr.cc
@@ -82,12 +82,12 @@ void Expr::Delete(Frame* /* f */)
 	Internal("Expr::Delete called");
 	}
 
-IntrusivePtr<Expr> Expr::MakeLvalue()
+zeek::IntrusivePtr<Expr> Expr::MakeLvalue()
 	{
 	if ( ! IsError() )
 		ExprError("can't be assigned to");
 
-	return {NewRef{}, this};
+	return {zeek::NewRef{}, this};
 	}
 
 void Expr::EvalIntoAggregate(const zeek::Type* /* t */, Val* /* aggr */,
@@ -96,12 +96,12 @@ void Expr::EvalIntoAggregate(const zeek::Type* /* t */, Val* /* aggr */,
 	Internal("Expr::EvalIntoAggregate called");
 	}
 
-void Expr::Assign(Frame* /* f */, IntrusivePtr<Val> /* v */)
+void Expr::Assign(Frame* /* f */, zeek::IntrusivePtr<Val> /* v */)
 	{
 	Internal("Expr::Assign called");
 	}
 
-IntrusivePtr<zeek::Type> Expr::InitType() const
+zeek::IntrusivePtr<zeek::Type> Expr::InitType() const
 	{
 	return type;
 	}
@@ -116,7 +116,7 @@ bool Expr::IsPure() const
 	return true;
 	}
 
-IntrusivePtr<Val> Expr::InitVal(const zeek::Type* t, IntrusivePtr<Val> aggr) const
+zeek::IntrusivePtr<Val> Expr::InitVal(const zeek::Type* t, zeek::IntrusivePtr<Val> aggr) const
 	{
 	if ( aggr )
 		{
@@ -182,7 +182,7 @@ void Expr::Canonicize()
 	{
 	}
 
-void Expr::SetType(IntrusivePtr<zeek::Type> t)
+void Expr::SetType(zeek::IntrusivePtr<zeek::Type> t)
 	{
 	if ( ! type || type->Tag() != zeek::TYPE_ERROR )
 		type = std::move(t);
@@ -215,13 +215,13 @@ void Expr::RuntimeErrorWithCallStack(const std::string& msg) const
 		}
 	}
 
-NameExpr::NameExpr(IntrusivePtr<ID> arg_id, bool const_init)
+NameExpr::NameExpr(zeek::IntrusivePtr<ID> arg_id, bool const_init)
 	: Expr(EXPR_NAME), id(std::move(arg_id))
 	{
 	in_const_init = const_init;
 
 	if ( id->IsType() )
-		SetType(make_intrusive<TypeType>(id->GetType()));
+		SetType(zeek::make_intrusive<TypeType>(id->GetType()));
 	else
 		SetType(id->GetType());
 
@@ -230,12 +230,12 @@ NameExpr::NameExpr(IntrusivePtr<ID> arg_id, bool const_init)
 		h->SetUsed();
 	}
 
-IntrusivePtr<Val> NameExpr::Eval(Frame* f) const
+zeek::IntrusivePtr<Val> NameExpr::Eval(Frame* f) const
 	{
-	IntrusivePtr<Val> v;
+	zeek::IntrusivePtr<Val> v;
 
 	if ( id->IsType() )
-		return make_intrusive<Val>(id->GetType(), true);
+		return zeek::make_intrusive<Val>(id->GetType(), true);
 
 	if ( id->IsGlobal() )
 		v = id->GetVal();
@@ -256,7 +256,7 @@ IntrusivePtr<Val> NameExpr::Eval(Frame* f) const
 		}
 	}
 
-IntrusivePtr<Expr> NameExpr::MakeLvalue()
+zeek::IntrusivePtr<Expr> NameExpr::MakeLvalue()
 	{
 	if ( id->IsType() )
 		ExprError("Type name is not an lvalue");
@@ -267,10 +267,10 @@ IntrusivePtr<Expr> NameExpr::MakeLvalue()
 	if ( id->IsOption() && ! in_const_init )
 		ExprError("option is not a modifiable lvalue");
 
-	return make_intrusive<RefExpr>(IntrusivePtr{NewRef{}, this});
+	return zeek::make_intrusive<RefExpr>(IntrusivePtr{zeek::NewRef{}, this});
 	}
 
-void NameExpr::Assign(Frame* f, IntrusivePtr<Val> v)
+void NameExpr::Assign(Frame* f, zeek::IntrusivePtr<Val> v)
 	{
 	if ( id->IsGlobal() )
 		id->SetVal(std::move(v));
@@ -309,7 +309,7 @@ void NameExpr::ExprDescribe(ODesc* d) const
 		}
 	}
 
-ConstExpr::ConstExpr(IntrusivePtr<Val> arg_val)
+ConstExpr::ConstExpr(zeek::IntrusivePtr<Val> arg_val)
 	: Expr(EXPR_CONST), val(std::move(arg_val))
 	{
 	if ( val->GetType()->Tag() == zeek::TYPE_LIST && val->AsListVal()->Length() == 1 )
@@ -323,9 +323,9 @@ void ConstExpr::ExprDescribe(ODesc* d) const
 	val->Describe(d);
 	}
 
-IntrusivePtr<Val> ConstExpr::Eval(Frame* /* f */) const
+zeek::IntrusivePtr<Val> ConstExpr::Eval(Frame* /* f */) const
 	{
-	return {NewRef{}, Value()};
+	return {zeek::NewRef{}, Value()};
 	}
 
 TraversalCode ConstExpr::Traverse(TraversalCallback* cb) const
@@ -337,14 +337,14 @@ TraversalCode ConstExpr::Traverse(TraversalCallback* cb) const
 	HANDLE_TC_EXPR_POST(tc);
 	}
 
-UnaryExpr::UnaryExpr(BroExprTag arg_tag, IntrusivePtr<Expr> arg_op)
+UnaryExpr::UnaryExpr(BroExprTag arg_tag, zeek::IntrusivePtr<Expr> arg_op)
 	: Expr(arg_tag), op(std::move(arg_op))
 	{
 	if ( op->IsError() )
 		SetError();
 	}
 
-IntrusivePtr<Val> UnaryExpr::Eval(Frame* f) const
+zeek::IntrusivePtr<Val> UnaryExpr::Eval(Frame* f) const
 	{
 	if ( IsError() )
 		return nullptr;
@@ -357,14 +357,14 @@ IntrusivePtr<Val> UnaryExpr::Eval(Frame* f) const
 	if ( is_vector(v) && Tag() != EXPR_IS && Tag() != EXPR_CAST )
 		{
 		VectorVal* v_op = v->AsVectorVal();
-		IntrusivePtr<zeek::VectorType> out_t;
+		zeek::IntrusivePtr<zeek::VectorType> out_t;
 
 		if ( GetType()->Tag() == zeek::TYPE_ANY )
 			out_t = v->GetType<zeek::VectorType>();
 		else
 			out_t = GetType<zeek::VectorType>();
 
-		auto result = make_intrusive<VectorVal>(std::move(out_t));
+		auto result = zeek::make_intrusive<VectorVal>(std::move(out_t));
 
 		for ( unsigned int i = 0; i < v_op->Size(); ++i )
 			{
@@ -397,9 +397,9 @@ TraversalCode UnaryExpr::Traverse(TraversalCallback* cb) const
 	HANDLE_TC_EXPR_POST(tc);
 	}
 
-IntrusivePtr<Val> UnaryExpr::Fold(Val* v) const
+zeek::IntrusivePtr<Val> UnaryExpr::Fold(Val* v) const
 	{
-	return {NewRef{}, v};
+	return {zeek::NewRef{}, v};
 	}
 
 void UnaryExpr::ExprDescribe(ODesc* d) const
@@ -426,7 +426,7 @@ void UnaryExpr::ExprDescribe(ODesc* d) const
 		}
 	}
 
-IntrusivePtr<Val> BinaryExpr::Eval(Frame* f) const
+zeek::IntrusivePtr<Val> BinaryExpr::Eval(Frame* f) const
 	{
 	if ( IsError() )
 		return nullptr;
@@ -455,7 +455,7 @@ IntrusivePtr<Val> BinaryExpr::Eval(Frame* f) const
 			return nullptr;
 			}
 
-		auto v_result = make_intrusive<VectorVal>(GetType<zeek::VectorType>());
+		auto v_result = zeek::make_intrusive<VectorVal>(GetType<zeek::VectorType>());
 
 		for ( unsigned int i = 0; i < v_op1->Size(); ++i )
 			{
@@ -472,7 +472,7 @@ IntrusivePtr<Val> BinaryExpr::Eval(Frame* f) const
 	if ( IsVector(GetType()->Tag()) && (is_vec1 || is_vec2) )
 		{ // fold vector against scalar
 		VectorVal* vv = (is_vec1 ? v1 : v2)->AsVectorVal();
-		auto v_result = make_intrusive<VectorVal>(GetType<zeek::VectorType>());
+		auto v_result = zeek::make_intrusive<VectorVal>(GetType<zeek::VectorType>());
 
 		for ( unsigned int i = 0; i < vv->Size(); ++i )
 			{
@@ -523,7 +523,7 @@ void BinaryExpr::ExprDescribe(ODesc* d) const
 	op2->Describe(d);
 	}
 
-IntrusivePtr<Val> BinaryExpr::Fold(Val* v1, Val* v2) const
+zeek::IntrusivePtr<Val> BinaryExpr::Fold(Val* v1, Val* v2) const
 	{
 	InternalTypeTag it = v1->GetType()->InternalType();
 
@@ -677,11 +677,11 @@ IntrusivePtr<Val> BinaryExpr::Fold(Val* v1, Val* v2) const
 	const auto& ret_type = IsVector(GetType()->Tag()) ? GetType()->Yield() : GetType();
 
 	if ( ret_type->Tag() == zeek::TYPE_INTERVAL )
-		return make_intrusive<IntervalVal>(d3);
+		return zeek::make_intrusive<IntervalVal>(d3);
 	else if ( ret_type->Tag() == zeek::TYPE_TIME )
-		return make_intrusive<TimeVal>(d3);
+		return zeek::make_intrusive<TimeVal>(d3);
 	else if ( ret_type->Tag() == zeek::TYPE_DOUBLE )
-		return make_intrusive<DoubleVal>(d3);
+		return zeek::make_intrusive<DoubleVal>(d3);
 	else if ( ret_type->InternalType() == zeek::TYPE_INTERNAL_UNSIGNED )
 		return val_mgr->Count(u3);
 	else if ( ret_type->Tag() == zeek::TYPE_BOOL )
@@ -690,7 +690,7 @@ IntrusivePtr<Val> BinaryExpr::Fold(Val* v1, Val* v2) const
 		return val_mgr->Int(i3);
 	}
 
-IntrusivePtr<Val> BinaryExpr::StringFold(Val* v1, Val* v2) const
+zeek::IntrusivePtr<Val> BinaryExpr::StringFold(Val* v1, Val* v2) const
 	{
 	const BroString* s1 = v1->AsString();
 	const BroString* s2 = v2->AsString();
@@ -714,7 +714,7 @@ IntrusivePtr<Val> BinaryExpr::StringFold(Val* v1, Val* v2) const
 		strings.push_back(s1);
 		strings.push_back(s2);
 
-		return make_intrusive<StringVal>(concatenate(strings));
+		return zeek::make_intrusive<StringVal>(concatenate(strings));
 		}
 
 	default:
@@ -725,7 +725,7 @@ IntrusivePtr<Val> BinaryExpr::StringFold(Val* v1, Val* v2) const
 	}
 
 
-IntrusivePtr<Val> BinaryExpr::PatternFold(Val* v1, Val* v2) const
+zeek::IntrusivePtr<Val> BinaryExpr::PatternFold(Val* v1, Val* v2) const
 	{
 	const RE_Matcher* re1 = v1->AsPattern();
 	const RE_Matcher* re2 = v2->AsPattern();
@@ -737,10 +737,10 @@ IntrusivePtr<Val> BinaryExpr::PatternFold(Val* v1, Val* v2) const
 		RE_Matcher_conjunction(re1, re2) :
 		RE_Matcher_disjunction(re1, re2);
 
-	return make_intrusive<PatternVal>(res);
+	return zeek::make_intrusive<PatternVal>(res);
 	}
 
-IntrusivePtr<Val> BinaryExpr::SetFold(Val* v1, Val* v2) const
+zeek::IntrusivePtr<Val> BinaryExpr::SetFold(Val* v1, Val* v2) const
 	{
 	TableVal* tv1 = v1->AsTableVal();
 	TableVal* tv2 = v2->AsTableVal();
@@ -800,7 +800,7 @@ IntrusivePtr<Val> BinaryExpr::SetFold(Val* v1, Val* v2) const
 	return val_mgr->Bool(res);
 	}
 
-IntrusivePtr<Val> BinaryExpr::AddrFold(Val* v1, Val* v2) const
+zeek::IntrusivePtr<Val> BinaryExpr::AddrFold(Val* v1, Val* v2) const
 	{
 	IPAddr a1 = v1->AsAddr();
 	IPAddr a2 = v2->AsAddr();
@@ -834,7 +834,7 @@ IntrusivePtr<Val> BinaryExpr::AddrFold(Val* v1, Val* v2) const
 	return val_mgr->Bool(result);
 	}
 
-IntrusivePtr<Val> BinaryExpr::SubNetFold(Val* v1, Val* v2) const
+zeek::IntrusivePtr<Val> BinaryExpr::SubNetFold(Val* v1, Val* v2) const
 	{
 	const IPPrefix& n1 = v1->AsSubNet();
 	const IPPrefix& n2 = v2->AsSubNet();
@@ -871,9 +871,9 @@ void BinaryExpr::PromoteOps(TypeTag t)
 		reporter->Warning("mixing vector and scalar operands is deprecated");
 
 	if ( bt1 != t )
-		op1 = make_intrusive<ArithCoerceExpr>(op1, t);
+		op1 = zeek::make_intrusive<ArithCoerceExpr>(op1, t);
 	if ( bt2 != t )
-		op2 = make_intrusive<ArithCoerceExpr>(op2, t);
+		op2 = zeek::make_intrusive<ArithCoerceExpr>(op2, t);
 	}
 
 void BinaryExpr::PromoteType(TypeTag t, bool is_vector)
@@ -881,12 +881,12 @@ void BinaryExpr::PromoteType(TypeTag t, bool is_vector)
 	PromoteOps(t);
 
 	if ( is_vector)
-		SetType(make_intrusive<zeek::VectorType>(base_type(t)));
+		SetType(zeek::make_intrusive<zeek::VectorType>(base_type(t)));
 	else
 		SetType(base_type(t));
 	}
 
-CloneExpr::CloneExpr(IntrusivePtr<Expr> arg_op)
+CloneExpr::CloneExpr(zeek::IntrusivePtr<Expr> arg_op)
 	: UnaryExpr(EXPR_CLONE, std::move(arg_op))
 	{
 	if ( IsError() )
@@ -895,7 +895,7 @@ CloneExpr::CloneExpr(IntrusivePtr<Expr> arg_op)
 	SetType(op->GetType());
 	}
 
-IntrusivePtr<Val> CloneExpr::Eval(Frame* f) const
+zeek::IntrusivePtr<Val> CloneExpr::Eval(Frame* f) const
 	{
 	if ( IsError() )
 		return nullptr;
@@ -906,12 +906,12 @@ IntrusivePtr<Val> CloneExpr::Eval(Frame* f) const
 	return nullptr;
 	}
 
-IntrusivePtr<Val> CloneExpr::Fold(Val* v) const
+zeek::IntrusivePtr<Val> CloneExpr::Fold(Val* v) const
 	{
 	return v->Clone();
 	}
 
-IncrExpr::IncrExpr(BroExprTag arg_tag, IntrusivePtr<Expr> arg_op)
+IncrExpr::IncrExpr(BroExprTag arg_tag, zeek::IntrusivePtr<Expr> arg_op)
 	: UnaryExpr(arg_tag, arg_op->MakeLvalue())
 	{
 	if ( IsError() )
@@ -938,7 +938,7 @@ IncrExpr::IncrExpr(BroExprTag arg_tag, IntrusivePtr<Expr> arg_op)
 		}
 	}
 
-IntrusivePtr<Val> IncrExpr::DoSingleEval(Frame* f, Val* v) const
+zeek::IntrusivePtr<Val> IncrExpr::DoSingleEval(Frame* f, Val* v) const
 	{
 	bro_int_t k = v->CoerceToInt();
 
@@ -962,7 +962,7 @@ IntrusivePtr<Val> IncrExpr::DoSingleEval(Frame* f, Val* v) const
 	}
 
 
-IntrusivePtr<Val> IncrExpr::Eval(Frame* f) const
+zeek::IntrusivePtr<Val> IncrExpr::Eval(Frame* f) const
 	{
 	auto v = op->Eval(f);
 
@@ -971,7 +971,7 @@ IntrusivePtr<Val> IncrExpr::Eval(Frame* f) const
 
 	if ( is_vector(v) )
 		{
-		IntrusivePtr<VectorVal> v_vec{NewRef{}, v->AsVectorVal()};
+		zeek::IntrusivePtr<VectorVal> v_vec{zeek::NewRef{}, v->AsVectorVal()};
 
 		for ( unsigned int i = 0; i < v_vec->Size(); ++i )
 			{
@@ -999,7 +999,7 @@ bool IncrExpr::IsPure() const
 	return false;
 	}
 
-ComplementExpr::ComplementExpr(IntrusivePtr<Expr> arg_op)
+ComplementExpr::ComplementExpr(zeek::IntrusivePtr<Expr> arg_op)
 	: UnaryExpr(EXPR_COMPLEMENT, std::move(arg_op))
 	{
 	if ( IsError() )
@@ -1014,12 +1014,12 @@ ComplementExpr::ComplementExpr(IntrusivePtr<Expr> arg_op)
 		SetType(base_type(zeek::TYPE_COUNT));
 	}
 
-IntrusivePtr<Val> ComplementExpr::Fold(Val* v) const
+zeek::IntrusivePtr<Val> ComplementExpr::Fold(Val* v) const
 	{
 	return val_mgr->Count(~ v->InternalUnsigned());
 	}
 
-NotExpr::NotExpr(IntrusivePtr<Expr> arg_op)
+NotExpr::NotExpr(zeek::IntrusivePtr<Expr> arg_op)
 	: UnaryExpr(EXPR_NOT, std::move(arg_op))
 	{
 	if ( IsError() )
@@ -1033,12 +1033,12 @@ NotExpr::NotExpr(IntrusivePtr<Expr> arg_op)
 		SetType(base_type(zeek::TYPE_BOOL));
 	}
 
-IntrusivePtr<Val> NotExpr::Fold(Val* v) const
+zeek::IntrusivePtr<Val> NotExpr::Fold(Val* v) const
 	{
 	return val_mgr->Bool(! v->InternalInt());
 	}
 
-PosExpr::PosExpr(IntrusivePtr<Expr> arg_op)
+PosExpr::PosExpr(zeek::IntrusivePtr<Expr> arg_op)
 	: UnaryExpr(EXPR_POSITIVE, std::move(arg_op))
 	{
 	if ( IsError() )
@@ -1047,7 +1047,7 @@ PosExpr::PosExpr(IntrusivePtr<Expr> arg_op)
 	const auto& t = IsVector(op->GetType()->Tag()) ? op->GetType()->Yield() : op->GetType();
 
 	TypeTag bt = t->Tag();
-	IntrusivePtr<zeek::Type> base_result_type;
+	zeek::IntrusivePtr<zeek::Type> base_result_type;
 
 	if ( IsIntegral(bt) )
 		// Promote count and counter to int.
@@ -1058,22 +1058,22 @@ PosExpr::PosExpr(IntrusivePtr<Expr> arg_op)
 		ExprError("requires an integral or double operand");
 
 	if ( is_vector(op) )
-		SetType(make_intrusive<zeek::VectorType>(std::move(base_result_type)));
+		SetType(zeek::make_intrusive<zeek::VectorType>(std::move(base_result_type)));
 	else
 		SetType(std::move(base_result_type));
 	}
 
-IntrusivePtr<Val> PosExpr::Fold(Val* v) const
+zeek::IntrusivePtr<Val> PosExpr::Fold(Val* v) const
 	{
 	TypeTag t = v->GetType()->Tag();
 
 	if ( t == zeek::TYPE_DOUBLE || t == zeek::TYPE_INTERVAL || t == zeek::TYPE_INT )
-		return {NewRef{}, v};
+		return {zeek::NewRef{}, v};
 	else
 		return val_mgr->Int(v->CoerceToInt());
 	}
 
-NegExpr::NegExpr(IntrusivePtr<Expr> arg_op)
+NegExpr::NegExpr(zeek::IntrusivePtr<Expr> arg_op)
 	: UnaryExpr(EXPR_NEGATE, std::move(arg_op))
 	{
 	if ( IsError() )
@@ -1082,7 +1082,7 @@ NegExpr::NegExpr(IntrusivePtr<Expr> arg_op)
 	const auto& t = IsVector(op->GetType()->Tag()) ? op->GetType()->Yield() : op->GetType();
 
 	TypeTag bt = t->Tag();
-	IntrusivePtr<zeek::Type> base_result_type;
+	zeek::IntrusivePtr<zeek::Type> base_result_type;
 
 	if ( IsIntegral(bt) )
 		// Promote count and counter to int.
@@ -1093,22 +1093,22 @@ NegExpr::NegExpr(IntrusivePtr<Expr> arg_op)
 		ExprError("requires an integral or double operand");
 
 	if ( is_vector(op) )
-		SetType(make_intrusive<zeek::VectorType>(std::move(base_result_type)));
+		SetType(zeek::make_intrusive<zeek::VectorType>(std::move(base_result_type)));
 	else
 		SetType(std::move(base_result_type));
 	}
 
-IntrusivePtr<Val> NegExpr::Fold(Val* v) const
+zeek::IntrusivePtr<Val> NegExpr::Fold(Val* v) const
 	{
 	if ( v->GetType()->Tag() == zeek::TYPE_DOUBLE )
-		return make_intrusive<DoubleVal>(- v->InternalDouble());
+		return zeek::make_intrusive<DoubleVal>(- v->InternalDouble());
 	else if ( v->GetType()->Tag() == zeek::TYPE_INTERVAL )
-		return make_intrusive<IntervalVal>(- v->InternalDouble());
+		return zeek::make_intrusive<IntervalVal>(- v->InternalDouble());
 	else
 		return val_mgr->Int(- v->CoerceToInt());
 	}
 
-SizeExpr::SizeExpr(IntrusivePtr<Expr> arg_op)
+SizeExpr::SizeExpr(zeek::IntrusivePtr<Expr> arg_op)
 	: UnaryExpr(EXPR_SIZE, std::move(arg_op))
 	{
 	if ( IsError() )
@@ -1120,7 +1120,7 @@ SizeExpr::SizeExpr(IntrusivePtr<Expr> arg_op)
 		SetType(base_type(zeek::TYPE_COUNT));
 	}
 
-IntrusivePtr<Val> SizeExpr::Eval(Frame* f) const
+zeek::IntrusivePtr<Val> SizeExpr::Eval(Frame* f) const
 	{
 	auto v = op->Eval(f);
 
@@ -1130,12 +1130,12 @@ IntrusivePtr<Val> SizeExpr::Eval(Frame* f) const
 	return Fold(v.get());
 	}
 
-IntrusivePtr<Val> SizeExpr::Fold(Val* v) const
+zeek::IntrusivePtr<Val> SizeExpr::Fold(Val* v) const
 	{
 	return v->SizeVal();
 	}
 
-AddExpr::AddExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
+AddExpr::AddExpr(zeek::IntrusivePtr<Expr> arg_op1, zeek::IntrusivePtr<Expr> arg_op2)
     : BinaryExpr(EXPR_ADD, std::move(arg_op1), std::move(arg_op2))
 	{
 	if ( IsError() )
@@ -1151,7 +1151,7 @@ AddExpr::AddExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
 	if ( IsVector(bt2) )
 		bt2 = op2->GetType()->AsVectorType()->Yield()->Tag();
 
-	IntrusivePtr<zeek::Type> base_result_type;
+	zeek::IntrusivePtr<zeek::Type> base_result_type;
 
 	if ( bt2 == zeek::TYPE_INTERVAL && ( bt1 == zeek::TYPE_TIME || bt1 == zeek::TYPE_INTERVAL ) )
 		base_result_type = base_type(bt1);
@@ -1167,7 +1167,7 @@ AddExpr::AddExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
 	if ( base_result_type )
 		{
 		if ( is_vector(op1) || is_vector(op2) )
-			SetType(make_intrusive<zeek::VectorType>(std::move(base_result_type)));
+			SetType(zeek::make_intrusive<zeek::VectorType>(std::move(base_result_type)));
 		else
 			SetType(std::move(base_result_type));
 		}
@@ -1182,7 +1182,7 @@ void AddExpr::Canonicize()
 		SwapOps();
 	}
 
-AddToExpr::AddToExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
+AddToExpr::AddToExpr(zeek::IntrusivePtr<Expr> arg_op1, zeek::IntrusivePtr<Expr> arg_op2)
 	: BinaryExpr(EXPR_ADD_TO, is_vector(arg_op1) ?
 	             std::move(arg_op1) : arg_op1->MakeLvalue(),
 	             std::move(arg_op2))
@@ -1207,7 +1207,7 @@ AddToExpr::AddToExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
 			if ( IsArithmetic(bt2) )
 				{
 				if ( bt2 != bt1 )
-					op2 = make_intrusive<ArithCoerceExpr>(std::move(op2), bt1);
+					op2 = zeek::make_intrusive<ArithCoerceExpr>(std::move(op2), bt1);
 
 				SetType(op1->GetType());
 				}
@@ -1228,7 +1228,7 @@ AddToExpr::AddToExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
 		ExprError("requires two arithmetic or two string operands");
 	}
 
-IntrusivePtr<Val> AddToExpr::Eval(Frame* f) const
+zeek::IntrusivePtr<Val> AddToExpr::Eval(Frame* f) const
 	{
 	auto v1 = op1->Eval(f);
 
@@ -1259,7 +1259,7 @@ IntrusivePtr<Val> AddToExpr::Eval(Frame* f) const
 		return nullptr;
 	}
 
-SubExpr::SubExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
+SubExpr::SubExpr(zeek::IntrusivePtr<Expr> arg_op1, zeek::IntrusivePtr<Expr> arg_op2)
 	: BinaryExpr(EXPR_SUB, std::move(arg_op1), std::move(arg_op2))
 	{
 	if ( IsError() )
@@ -1276,7 +1276,7 @@ SubExpr::SubExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
 	if ( IsVector(bt2) )
 		bt2 = t2->AsVectorType()->Yield()->Tag();
 
-	IntrusivePtr<zeek::Type> base_result_type;
+	zeek::IntrusivePtr<zeek::Type> base_result_type;
 
 	if ( bt2 == zeek::TYPE_INTERVAL && ( bt1 == zeek::TYPE_TIME || bt1 == zeek::TYPE_INTERVAL ) )
 		base_result_type = base_type(bt1);
@@ -1301,14 +1301,14 @@ SubExpr::SubExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
 	if ( base_result_type )
 		{
 		if ( is_vector(op1) || is_vector(op2) )
-			SetType(make_intrusive<zeek::VectorType>(std::move(base_result_type)));
+			SetType(zeek::make_intrusive<zeek::VectorType>(std::move(base_result_type)));
 		else
 			SetType(std::move(base_result_type));
 		}
 	}
 
-RemoveFromExpr::RemoveFromExpr(IntrusivePtr<Expr> arg_op1,
-							   IntrusivePtr<Expr> arg_op2)
+RemoveFromExpr::RemoveFromExpr(zeek::IntrusivePtr<Expr> arg_op1,
+							   zeek::IntrusivePtr<Expr> arg_op2)
 	: BinaryExpr(EXPR_REMOVE_FROM, arg_op1->MakeLvalue(), std::move(arg_op2))
 	{
 	if ( IsError() )
@@ -1325,7 +1325,7 @@ RemoveFromExpr::RemoveFromExpr(IntrusivePtr<Expr> arg_op1,
 		ExprError("requires two arithmetic operands");
 	}
 
-IntrusivePtr<Val> RemoveFromExpr::Eval(Frame* f) const
+zeek::IntrusivePtr<Val> RemoveFromExpr::Eval(Frame* f) const
 	{
 	auto v1 = op1->Eval(f);
 
@@ -1346,7 +1346,7 @@ IntrusivePtr<Val> RemoveFromExpr::Eval(Frame* f) const
 		return nullptr;
 	}
 
-TimesExpr::TimesExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
+TimesExpr::TimesExpr(zeek::IntrusivePtr<Expr> arg_op1, zeek::IntrusivePtr<Expr> arg_op2)
 	: BinaryExpr(EXPR_TIMES, std::move(arg_op1), std::move(arg_op2))
 	{
 	if ( IsError() )
@@ -1384,8 +1384,8 @@ void TimesExpr::Canonicize()
 		SwapOps();
 	}
 
-DivideExpr::DivideExpr(IntrusivePtr<Expr> arg_op1,
-                       IntrusivePtr<Expr> arg_op2)
+DivideExpr::DivideExpr(zeek::IntrusivePtr<Expr> arg_op1,
+                       zeek::IntrusivePtr<Expr> arg_op2)
 	: BinaryExpr(EXPR_DIVIDE, std::move(arg_op1), std::move(arg_op2))
 	{
 	if ( IsError() )
@@ -1408,7 +1408,7 @@ DivideExpr::DivideExpr(IntrusivePtr<Expr> arg_op1,
 		else if ( bt1 == zeek::TYPE_INTERVAL && bt2 == zeek::TYPE_INTERVAL )
 			{
 			if ( is_vector(op1) || is_vector(op2) )
-				SetType(make_intrusive<zeek::VectorType>(base_type(zeek::TYPE_DOUBLE)));
+				SetType(zeek::make_intrusive<zeek::VectorType>(base_type(zeek::TYPE_DOUBLE)));
 			else
 				SetType(base_type(zeek::TYPE_DOUBLE));
 			}
@@ -1427,7 +1427,7 @@ DivideExpr::DivideExpr(IntrusivePtr<Expr> arg_op1,
 		ExprError("requires arithmetic operands");
 	}
 
-IntrusivePtr<Val> DivideExpr::AddrFold(Val* v1, Val* v2) const
+zeek::IntrusivePtr<Val> DivideExpr::AddrFold(Val* v1, Val* v2) const
 	{
 	uint32_t mask;
 
@@ -1449,10 +1449,10 @@ IntrusivePtr<Val> DivideExpr::AddrFold(Val* v1, Val* v2) const
 			RuntimeError(fmt("bad IPv6 subnet prefix length: %" PRIu32, mask));
 		}
 
-	return make_intrusive<SubNetVal>(a, mask);
+	return zeek::make_intrusive<SubNetVal>(a, mask);
 	}
 
-ModExpr::ModExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
+ModExpr::ModExpr(zeek::IntrusivePtr<Expr> arg_op1, zeek::IntrusivePtr<Expr> arg_op2)
 	: BinaryExpr(EXPR_MOD, std::move(arg_op1), std::move(arg_op2))
 	{
 	if ( IsError() )
@@ -1475,7 +1475,8 @@ ModExpr::ModExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
 	}
 
 BoolExpr::BoolExpr(BroExprTag arg_tag,
-				   IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
+				   zeek::IntrusivePtr<Expr> arg_op1,
+                   zeek::IntrusivePtr<Expr> arg_op2)
 	: BinaryExpr(arg_tag, std::move(arg_op1), std::move(arg_op2))
 	{
 	if ( IsError() )
@@ -1497,7 +1498,7 @@ BoolExpr::BoolExpr(BroExprTag arg_tag,
 			{
 			if ( ! (is_vector(op1) && is_vector(op2)) )
 				reporter->Warning("mixing vector and scalar operands is deprecated");
-			SetType(make_intrusive<zeek::VectorType>(base_type(zeek::TYPE_BOOL)));
+			SetType(zeek::make_intrusive<zeek::VectorType>(base_type(zeek::TYPE_BOOL)));
 			}
 		else
 			SetType(base_type(zeek::TYPE_BOOL));
@@ -1506,7 +1507,7 @@ BoolExpr::BoolExpr(BroExprTag arg_tag,
 		ExprError("requires boolean operands");
 	}
 
-IntrusivePtr<Val> BoolExpr::DoSingleEval(Frame* f, IntrusivePtr<Val> v1, Expr* op2) const
+zeek::IntrusivePtr<Val> BoolExpr::DoSingleEval(Frame* f, zeek::IntrusivePtr<Val> v1, Expr* op2) const
 	{
 	if ( ! v1 )
 		return nullptr;
@@ -1528,7 +1529,7 @@ IntrusivePtr<Val> BoolExpr::DoSingleEval(Frame* f, IntrusivePtr<Val> v1, Expr* o
 		}
 	}
 
-IntrusivePtr<Val> BoolExpr::Eval(Frame* f) const
+zeek::IntrusivePtr<Val> BoolExpr::Eval(Frame* f) const
 	{
 	if ( IsError() )
 		return nullptr;
@@ -1550,31 +1551,31 @@ IntrusivePtr<Val> BoolExpr::Eval(Frame* f) const
 	// a vector in order to find out its length.
 	if ( ! (is_vec1 && is_vec2) )
 		{ // Only one is a vector.
-		IntrusivePtr<Val> scalar_v;
-		IntrusivePtr<VectorVal> vector_v;
+		zeek::IntrusivePtr<Val> scalar_v;
+		zeek::IntrusivePtr<VectorVal> vector_v;
 
 		if ( is_vec1 )
 			{
 			scalar_v = op2->Eval(f);
-			vector_v = {AdoptRef{}, v1.release()->AsVectorVal()};
+			vector_v = {zeek::AdoptRef{}, v1.release()->AsVectorVal()};
 			}
 		else
 			{
 			scalar_v = std::move(v1);
-			vector_v = {AdoptRef{}, op2->Eval(f).release()->AsVectorVal()};
+			vector_v = {zeek::AdoptRef{}, op2->Eval(f).release()->AsVectorVal()};
 			}
 
 		if ( ! scalar_v || ! vector_v )
 			return nullptr;
 
-		IntrusivePtr<VectorVal> result;
+		zeek::IntrusivePtr<VectorVal> result;
 
 		// It's either an EXPR_AND_AND or an EXPR_OR_OR.
 		bool is_and = (tag == EXPR_AND_AND);
 
 		if ( scalar_v->IsZero() == is_and )
 			{
-			result = make_intrusive<VectorVal>(GetType<zeek::VectorType>());
+			result = zeek::make_intrusive<VectorVal>(GetType<zeek::VectorType>());
 			result->Resize(vector_v->Size());
 			result->AssignRepeat(0, result->Size(), std::move(scalar_v));
 			}
@@ -1599,7 +1600,7 @@ IntrusivePtr<Val> BoolExpr::Eval(Frame* f) const
 		return nullptr;
 		}
 
-	auto result = make_intrusive<VectorVal>(GetType<zeek::VectorType>());
+	auto result = zeek::make_intrusive<VectorVal>(GetType<zeek::VectorType>());
 	result->Resize(vec_v1->Size());
 
 	for ( unsigned int i = 0; i < vec_v1->Size(); ++i )
@@ -1622,7 +1623,8 @@ IntrusivePtr<Val> BoolExpr::Eval(Frame* f) const
 	}
 
 BitExpr::BitExpr(BroExprTag arg_tag,
-                 IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
+                 zeek::IntrusivePtr<Expr> arg_op1,
+                 zeek::IntrusivePtr<Expr> arg_op2)
 	: BinaryExpr(arg_tag, std::move(arg_op1), std::move(arg_op2))
 	{
 	if ( IsError() )
@@ -1647,7 +1649,7 @@ BitExpr::BitExpr(BroExprTag arg_tag,
 		if ( bt1 == zeek::TYPE_COUNTER && bt2 == zeek::TYPE_COUNTER )
 			ExprError("cannot apply a bitwise operator to two \"counter\" operands");
 		else if ( is_vector(op1) || is_vector(op2) )
-			SetType(make_intrusive<zeek::VectorType>(base_type(zeek::TYPE_COUNT)));
+			SetType(zeek::make_intrusive<zeek::VectorType>(base_type(zeek::TYPE_COUNT)));
 		else
 			SetType(base_type(zeek::TYPE_COUNT));
 		}
@@ -1675,7 +1677,8 @@ BitExpr::BitExpr(BroExprTag arg_tag,
 	}
 
 EqExpr::EqExpr(BroExprTag arg_tag,
-               IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
+               zeek::IntrusivePtr<Expr> arg_op1,
+               zeek::IntrusivePtr<Expr> arg_op2)
 	: BinaryExpr(arg_tag, std::move(arg_op1), std::move(arg_op2))
 	{
 	if ( IsError() )
@@ -1695,7 +1698,7 @@ EqExpr::EqExpr(BroExprTag arg_tag,
 		bt2 = t2->AsVectorType()->Yield()->Tag();
 
 	if ( is_vector(op1) || is_vector(op2) )
-		SetType(make_intrusive<zeek::VectorType>(base_type(zeek::TYPE_BOOL)));
+		SetType(zeek::make_intrusive<zeek::VectorType>(base_type(zeek::TYPE_BOOL)));
 	else
 		SetType(base_type(zeek::TYPE_BOOL));
 
@@ -1760,7 +1763,7 @@ void EqExpr::Canonicize()
 		SwapOps();
 	}
 
-IntrusivePtr<Val> EqExpr::Fold(Val* v1, Val* v2) const
+zeek::IntrusivePtr<Val> EqExpr::Fold(Val* v1, Val* v2) const
 	{
 	if ( op1->GetType()->Tag() == zeek::TYPE_PATTERN )
 		{
@@ -1777,7 +1780,8 @@ IntrusivePtr<Val> EqExpr::Fold(Val* v1, Val* v2) const
 	}
 
 RelExpr::RelExpr(BroExprTag arg_tag,
-                 IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
+                 zeek::IntrusivePtr<Expr> arg_op1,
+                 zeek::IntrusivePtr<Expr> arg_op2)
 	: BinaryExpr(arg_tag, std::move(arg_op1), std::move(arg_op2))
 	{
 	if ( IsError() )
@@ -1797,7 +1801,7 @@ RelExpr::RelExpr(BroExprTag arg_tag,
 		bt2 = t2->AsVectorType()->Yield()->Tag();
 
 	if ( is_vector(op1) || is_vector(op2) )
-		SetType(make_intrusive<zeek::VectorType>(base_type(zeek::TYPE_BOOL)));
+		SetType(zeek::make_intrusive<zeek::VectorType>(base_type(zeek::TYPE_BOOL)));
 	else
 		SetType(base_type(zeek::TYPE_BOOL));
 
@@ -1834,8 +1838,9 @@ void RelExpr::Canonicize()
 		}
 	}
 
-CondExpr::CondExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2,
-                   IntrusivePtr<Expr> arg_op3)
+CondExpr::CondExpr(zeek::IntrusivePtr<Expr> arg_op1,
+                   zeek::IntrusivePtr<Expr> arg_op2,
+                   zeek::IntrusivePtr<Expr> arg_op3)
 	: Expr(EXPR_COND),
 	  op1(std::move(arg_op1)), op2(std::move(arg_op2)), op3(std::move(arg_op3))
 	{
@@ -1872,12 +1877,12 @@ CondExpr::CondExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2,
 			{
 			TypeTag t = max_type(bt2, bt3);
 			if ( bt2 != t )
-				op2 = make_intrusive<ArithCoerceExpr>(std::move(op2), t);
+				op2 = zeek::make_intrusive<ArithCoerceExpr>(std::move(op2), t);
 			if ( bt3 != t )
-				op3 = make_intrusive<ArithCoerceExpr>(std::move(op3), t);
+				op3 = zeek::make_intrusive<ArithCoerceExpr>(std::move(op3), t);
 
 			if ( is_vector(op2) )
-				SetType(make_intrusive<zeek::VectorType>(base_type(t)));
+				SetType(zeek::make_intrusive<zeek::VectorType>(base_type(t)));
 			else
 				SetType(base_type(t));
 			}
@@ -1896,7 +1901,7 @@ CondExpr::CondExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2,
 		}
 	}
 
-IntrusivePtr<Val> CondExpr::Eval(Frame* f) const
+zeek::IntrusivePtr<Val> CondExpr::Eval(Frame* f) const
 	{
 	if ( ! is_vector(op1) )
 		{
@@ -1931,7 +1936,7 @@ IntrusivePtr<Val> CondExpr::Eval(Frame* f) const
 		return nullptr;
 		}
 
-	auto result = make_intrusive<VectorVal>(GetType<zeek::VectorType>());
+	auto result = zeek::make_intrusive<VectorVal>(GetType<zeek::VectorType>());
 	result->Resize(cond->Size());
 
 	for ( unsigned int i = 0; i < cond->Size(); ++i )
@@ -1982,7 +1987,7 @@ void CondExpr::ExprDescribe(ODesc* d) const
 	op3->Describe(d);
 	}
 
-RefExpr::RefExpr(IntrusivePtr<Expr> arg_op)
+RefExpr::RefExpr(zeek::IntrusivePtr<Expr> arg_op)
 	: UnaryExpr(EXPR_REF, std::move(arg_op))
 	{
 	if ( IsError() )
@@ -1994,19 +1999,20 @@ RefExpr::RefExpr(IntrusivePtr<Expr> arg_op)
 		SetType(op->GetType());
 	}
 
-IntrusivePtr<Expr> RefExpr::MakeLvalue()
+zeek::IntrusivePtr<Expr> RefExpr::MakeLvalue()
 	{
-	return {NewRef{}, this};
+	return {zeek::NewRef{}, this};
 	}
 
-void RefExpr::Assign(Frame* f, IntrusivePtr<Val> v)
+void RefExpr::Assign(Frame* f, zeek::IntrusivePtr<Val> v)
 	{
 	op->Assign(f, std::move(v));
 	}
 
-AssignExpr::AssignExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2,
-                       bool arg_is_init, IntrusivePtr<Val> arg_val,
-                       const IntrusivePtr<Attributes>& attrs)
+AssignExpr::AssignExpr(zeek::IntrusivePtr<Expr> arg_op1,
+                       zeek::IntrusivePtr<Expr> arg_op2,
+                       bool arg_is_init, zeek::IntrusivePtr<Val> arg_val,
+                       const zeek::IntrusivePtr<Attributes>& attrs)
 	: BinaryExpr(EXPR_ASSIGN, arg_is_init ?
 	             std::move(arg_op1) : arg_op1->MakeLvalue(),
 	             std::move(arg_op2))
@@ -2038,7 +2044,7 @@ AssignExpr::AssignExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2,
 	SetLocationInfo(op1->GetLocationInfo(), op2->GetLocationInfo());
 	}
 
-bool AssignExpr::TypeCheck(const IntrusivePtr<Attributes>& attrs)
+bool AssignExpr::TypeCheck(const zeek::IntrusivePtr<Attributes>& attrs)
 	{
 	TypeTag bt1 = op1->GetType()->Tag();
 	TypeTag bt2 = op2->GetType()->Tag();
@@ -2060,32 +2066,32 @@ bool AssignExpr::TypeCheck(const IntrusivePtr<Attributes>& attrs)
 
 	if ( bt1 == zeek::TYPE_TIME && IsArithmetic(bt2) && op2->IsZero() )
 		{ // Allow assignments to zero as a special case.
-		op2 = make_intrusive<ArithCoerceExpr>(std::move(op2), bt1);
+		op2 = zeek::make_intrusive<ArithCoerceExpr>(std::move(op2), bt1);
 		return true;
 		}
 
 	if ( bt1 == zeek::TYPE_TABLE && bt2 == bt1 &&
 	     op2->GetType()->AsTableType()->IsUnspecifiedTable() )
 		{
-		op2 = make_intrusive<TableCoerceExpr>(std::move(op2), op1->GetType<TableType>());
+		op2 = zeek::make_intrusive<TableCoerceExpr>(std::move(op2), op1->GetType<TableType>());
 		return true;
 		}
 
 	if ( bt1 == zeek::TYPE_TABLE && op2->Tag() == EXPR_LIST )
 		{
-		std::unique_ptr<std::vector<IntrusivePtr<Attr>>> attr_copy;
+		std::unique_ptr<std::vector<zeek::IntrusivePtr<Attr>>> attr_copy;
 
 		if ( attrs )
-			attr_copy = std::make_unique<std::vector<IntrusivePtr<Attr>>>(attrs->GetAttrs());
+	        attr_copy = std::make_unique<std::vector<zeek::IntrusivePtr<Attr>>>(attrs->GetAttrs());
 
 		bool empty_list_assignment = (op2->AsListExpr()->Exprs().empty());
 
 		if ( op1->GetType()->IsSet() )
-			op2 = make_intrusive<SetConstructorExpr>(
-			        cast_intrusive<ListExpr>(op2), std::move(attr_copy));
+			op2 = zeek::make_intrusive<SetConstructorExpr>(
+			        zeek::cast_intrusive<ListExpr>(op2), std::move(attr_copy));
 		else
-			op2 = make_intrusive<TableConstructorExpr>(
-			        cast_intrusive<ListExpr>(op2), std::move(attr_copy));
+			op2 = zeek::make_intrusive<TableConstructorExpr>(
+			        zeek::cast_intrusive<ListExpr>(op2), std::move(attr_copy));
 
 		if ( ! empty_list_assignment && ! same_type(op1->GetType(), op2->GetType()) )
 			{
@@ -2104,15 +2110,15 @@ bool AssignExpr::TypeCheck(const IntrusivePtr<Attributes>& attrs)
 		{
 		if ( bt2 == bt1 && op2->GetType()->AsVectorType()->IsUnspecifiedVector() )
 			{
-			op2 = make_intrusive<VectorCoerceExpr>(std::move(op2), op1->GetType<zeek::VectorType>());
+			op2 = zeek::make_intrusive<VectorCoerceExpr>(std::move(op2), op1->GetType<zeek::VectorType>());
 			return true;
 			}
 
 		if ( op2->Tag() == EXPR_LIST )
 			{
-			op2 = make_intrusive<VectorConstructorExpr>(
-			        IntrusivePtr{AdoptRef{}, op2.release()->AsListExpr()},
-			        op1->GetType());
+			op2 = zeek::make_intrusive<VectorConstructorExpr>(
+				IntrusivePtr{zeek::AdoptRef{}, op2.release()->AsListExpr()},
+				op1->GetType());
 			return true;
 			}
 		}
@@ -2138,7 +2144,7 @@ bool AssignExpr::TypeCheck(const IntrusivePtr<Attributes>& attrs)
 			}
 
 		// Need to coerce.
-		op2 = make_intrusive<RecordCoerceExpr>(std::move(op2), op1->GetType<RecordType>());
+		op2 = zeek::make_intrusive<RecordCoerceExpr>(std::move(op2), op1->GetType<RecordType>());
 		return true;
 		}
 
@@ -2167,20 +2173,20 @@ bool AssignExpr::TypeCheck(const IntrusivePtr<Attributes>& attrs)
 					return false;
 					}
 
-				std::unique_ptr<std::vector<IntrusivePtr<Attr>>> attr_copy;
+				std::unique_ptr<std::vector<zeek::IntrusivePtr<Attr>>> attr_copy;
 
 
 				if ( sce->GetAttrs() )
 					{
 					const auto& a = sce->GetAttrs()->GetAttrs();
-					attr_copy = std::make_unique<std::vector<IntrusivePtr<Attr>>>(a);
+					attr_copy = std::make_unique<std::vector<zeek::IntrusivePtr<Attr>>>(a);
 					}
 
 				int errors_before = reporter->Errors();
-				op2 = make_intrusive<SetConstructorExpr>(
-				        IntrusivePtr{NewRef{}, ctor_list},
-				        std::move(attr_copy),
-				        op1->GetType());
+				op2 = zeek::make_intrusive<SetConstructorExpr>(
+					IntrusivePtr{zeek::NewRef{}, ctor_list},
+					std::move(attr_copy),
+					op1->GetType());
 				int errors_after = reporter->Errors();
 
 				if ( errors_after > errors_before )
@@ -2218,7 +2224,7 @@ bool AssignExpr::TypeCheckArithmetics(TypeTag bt1, TypeTag bt2)
 	if ( bt2 == zeek::TYPE_DOUBLE )
 		{
 		Warn("dangerous assignment of double to integral");
-		op2 = make_intrusive<ArithCoerceExpr>(std::move(op2), bt1);
+		op2 = zeek::make_intrusive<ArithCoerceExpr>(std::move(op2), bt1);
 		bt2 = op2->GetType()->Tag();
 		}
 
@@ -2229,7 +2235,7 @@ bool AssignExpr::TypeCheckArithmetics(TypeTag bt1, TypeTag bt2)
 		if ( bt2 == zeek::TYPE_INT )
 			{
 			Warn("dangerous assignment of integer to count");
-			op2 = make_intrusive<ArithCoerceExpr>(std::move(op2), bt1);
+			op2 = zeek::make_intrusive<ArithCoerceExpr>(std::move(op2), bt1);
 			}
 
 		// Assignment of count to counter or vice
@@ -2241,7 +2247,7 @@ bool AssignExpr::TypeCheckArithmetics(TypeTag bt1, TypeTag bt2)
 	}
 
 
-IntrusivePtr<Val> AssignExpr::Eval(Frame* f) const
+zeek::IntrusivePtr<Val> AssignExpr::Eval(Frame* f) const
 	{
 	if ( is_init )
 		{
@@ -2262,7 +2268,7 @@ IntrusivePtr<Val> AssignExpr::Eval(Frame* f) const
 		return nullptr;
 	}
 
-IntrusivePtr<zeek::Type> AssignExpr::InitType() const
+zeek::IntrusivePtr<zeek::Type> AssignExpr::InitType() const
 	{
 	if ( op1->Tag() != EXPR_LIST )
 		{
@@ -2274,8 +2280,9 @@ IntrusivePtr<zeek::Type> AssignExpr::InitType() const
 	if ( tl->Tag() != zeek::TYPE_LIST )
 		Internal("inconsistent list expr in AssignExpr::InitType");
 
-	return make_intrusive<TableType>(IntrusivePtr{NewRef{}, tl->AsTypeList()},
-	                                 op2->GetType());
+	return zeek::make_intrusive<TableType>(
+		IntrusivePtr{zeek::NewRef{}, tl->AsTypeList()},
+		op2->GetType());
 	}
 
 void AssignExpr::EvalIntoAggregate(const zeek::Type* t, Val* aggr, Frame* f) const
@@ -2327,7 +2334,7 @@ void AssignExpr::EvalIntoAggregate(const zeek::Type* t, Val* aggr, Frame* f) con
 		RuntimeError("type clash in table assignment");
 	}
 
-IntrusivePtr<Val> AssignExpr::InitVal(const zeek::Type* t, IntrusivePtr<Val> aggr) const
+zeek::IntrusivePtr<Val> AssignExpr::InitVal(const zeek::Type* t, zeek::IntrusivePtr<Val> aggr) const
 	{
 	if ( ! aggr )
 		{
@@ -2382,7 +2389,7 @@ IntrusivePtr<Val> AssignExpr::InitVal(const zeek::Type* t, IntrusivePtr<Val> agg
 		if ( aggr->GetType()->Tag() != zeek::TYPE_TABLE )
 			Internal("bad aggregate in AssignExpr::InitVal");
 
-		auto tv = cast_intrusive<TableVal>(std::move(aggr));
+		auto tv = zeek::cast_intrusive<TableVal>(std::move(aggr));
 		const TableType* tt = tv->GetType()->AsTableType();
 		const auto& yt = tv->GetType()->Yield();
 
@@ -2427,13 +2434,13 @@ bool AssignExpr::IsPure() const
 	return false;
 	}
 
-IndexSliceAssignExpr::IndexSliceAssignExpr(IntrusivePtr<Expr> op1,
-                                           IntrusivePtr<Expr> op2, bool is_init)
+IndexSliceAssignExpr::IndexSliceAssignExpr(zeek::IntrusivePtr<Expr> op1,
+                                           zeek::IntrusivePtr<Expr> op2, bool is_init)
 	: AssignExpr(std::move(op1), std::move(op2), is_init)
 	{
 	}
 
-IntrusivePtr<Val> IndexSliceAssignExpr::Eval(Frame* f) const
+zeek::IntrusivePtr<Val> IndexSliceAssignExpr::Eval(Frame* f) const
 	{
 	if ( is_init )
 		{
@@ -2447,8 +2454,8 @@ IntrusivePtr<Val> IndexSliceAssignExpr::Eval(Frame* f) const
 	return nullptr;
 	}
 
-IndexExpr::IndexExpr(IntrusivePtr<Expr> arg_op1,
-                     IntrusivePtr<ListExpr> arg_op2, bool arg_is_slice)
+IndexExpr::IndexExpr(zeek::IntrusivePtr<Expr> arg_op1,
+                     zeek::IntrusivePtr<ListExpr> arg_op2, bool arg_is_slice)
 	: BinaryExpr(EXPR_INDEX, std::move(arg_op1), std::move(arg_op2)),
 	  is_slice(arg_is_slice)
 	{
@@ -2496,7 +2503,7 @@ IndexExpr::IndexExpr(IntrusivePtr<Expr> arg_op1,
 		SetType(op1->GetType()->Yield());
 
 	else if ( match_type == MATCHES_INDEX_VECTOR )
-		SetType(make_intrusive<zeek::VectorType>(op1->GetType()->Yield()));
+		SetType(zeek::make_intrusive<zeek::VectorType>(op1->GetType()->Yield()));
 
 	else
 		ExprError("Unknown MatchesIndex() return value");
@@ -2555,15 +2562,15 @@ void IndexExpr::Delete(Frame* f)
 	v1->AsTableVal()->Remove(*v2);
 	}
 
-IntrusivePtr<Expr> IndexExpr::MakeLvalue()
+zeek::IntrusivePtr<Expr> IndexExpr::MakeLvalue()
 	{
 	if ( IsString(op1->GetType()->Tag()) )
 		ExprError("cannot assign to string index expression");
 
-	return make_intrusive<RefExpr>(IntrusivePtr{NewRef{}, this});
+	return zeek::make_intrusive<RefExpr>(IntrusivePtr{zeek::NewRef{}, this});
 	}
 
-IntrusivePtr<Val> IndexExpr::Eval(Frame* f) const
+zeek::IntrusivePtr<Val> IndexExpr::Eval(Frame* f) const
 	{
 	auto v1 = op1->Eval(f);
 
@@ -2581,7 +2588,7 @@ IntrusivePtr<Val> IndexExpr::Eval(Frame* f) const
 		{
 		VectorVal* v_v1 = v1->AsVectorVal();
 		VectorVal* v_v2 = indv->AsVectorVal();
-		auto v_result = make_intrusive<VectorVal>(GetType<zeek::VectorType>());
+		auto v_result = zeek::make_intrusive<VectorVal>(GetType<zeek::VectorType>());
 
 		// Booleans select each element (or not).
 		if ( IsBool(v_v2->GetType()->Yield()->Tag()) )
@@ -2624,12 +2631,12 @@ static int get_slice_index(int idx, int len)
 	return idx;
 	}
 
-IntrusivePtr<Val> IndexExpr::Fold(Val* v1, Val* v2) const
+zeek::IntrusivePtr<Val> IndexExpr::Fold(Val* v1, Val* v2) const
 	{
 	if ( IsError() )
 		return nullptr;
 
-	IntrusivePtr<Val> v;
+	zeek::IntrusivePtr<Val> v;
 
 	switch ( v1->GetType()->Tag() ) {
 	case zeek::TYPE_VECTOR:
@@ -2642,7 +2649,7 @@ IntrusivePtr<Val> IndexExpr::Fold(Val* v1, Val* v2) const
 		else
 			{
 			size_t len = vect->Size();
-			auto result = make_intrusive<VectorVal>(vect->GetType<zeek::VectorType>());
+			auto result = zeek::make_intrusive<VectorVal>(vect->GetType<zeek::VectorType>());
 
 			bro_int_t first = get_slice_index(lv->Idx(0)->CoerceToInt(), len);
 			bro_int_t last = get_slice_index(lv->Idx(1)->CoerceToInt(), len);
@@ -2662,7 +2669,7 @@ IntrusivePtr<Val> IndexExpr::Fold(Val* v1, Val* v2) const
 		break;
 
 	case zeek::TYPE_TABLE:
-		v = v1->AsTableVal()->FindOrDefault({NewRef{}, v2}); // Then, we jump into the TableVal here.
+		v = v1->AsTableVal()->FindOrDefault({zeek::NewRef{}, v2}); // Then, we jump into the TableVal here.
 		break;
 
 	case zeek::TYPE_STRING:
@@ -2694,7 +2701,7 @@ IntrusivePtr<Val> IndexExpr::Fold(Val* v1, Val* v2) const
 				substring = s->GetSubstring(first, substring_len);
 			}
 
-		return make_intrusive<StringVal>(substring ? substring : new BroString(""));
+		return zeek::make_intrusive<StringVal>(substring ? substring : new BroString(""));
 		}
 
 	default:
@@ -2709,7 +2716,7 @@ IntrusivePtr<Val> IndexExpr::Fold(Val* v1, Val* v2) const
 	return nullptr;
 	}
 
-void IndexExpr::Assign(Frame* f, IntrusivePtr<Val> v)
+void IndexExpr::Assign(Frame* f, zeek::IntrusivePtr<Val> v)
 	{
 	if ( IsError() )
 		return;
@@ -2829,7 +2836,7 @@ TraversalCode IndexExpr::Traverse(TraversalCallback* cb) const
 	HANDLE_TC_EXPR_POST(tc);
 	}
 
-FieldExpr::FieldExpr(IntrusivePtr<Expr> arg_op, const char* arg_field_name)
+FieldExpr::FieldExpr(zeek::IntrusivePtr<Expr> arg_op, const char* arg_field_name)
 	: UnaryExpr(EXPR_FIELD, std::move(arg_op)),
 	  field_name(copy_string(arg_field_name)), td(nullptr), field(0)
 	{
@@ -2861,9 +2868,9 @@ FieldExpr::~FieldExpr()
 	delete [] field_name;
 	}
 
-IntrusivePtr<Expr> FieldExpr::MakeLvalue()
+zeek::IntrusivePtr<Expr> FieldExpr::MakeLvalue()
 	{
-	return make_intrusive<RefExpr>(IntrusivePtr{NewRef{}, this});
+	return zeek::make_intrusive<RefExpr>(IntrusivePtr{zeek::NewRef{}, this});
 	}
 
 bool FieldExpr::CanDel() const
@@ -2871,7 +2878,7 @@ bool FieldExpr::CanDel() const
 	return td->GetAttr(ATTR_DEFAULT) || td->GetAttr(ATTR_OPTIONAL);
 	}
 
-void FieldExpr::Assign(Frame* f, IntrusivePtr<Val> v)
+void FieldExpr::Assign(Frame* f, zeek::IntrusivePtr<Val> v)
 	{
 	if ( IsError() )
 		return;
@@ -2888,7 +2895,7 @@ void FieldExpr::Delete(Frame* f)
 	Assign(f, nullptr);
 	}
 
-IntrusivePtr<Val> FieldExpr::Fold(Val* v) const
+zeek::IntrusivePtr<Val> FieldExpr::Fold(Val* v) const
 	{
 	if ( const auto& result = v->AsRecordVal()->GetField(field) )
 		return result;
@@ -2920,7 +2927,7 @@ void FieldExpr::ExprDescribe(ODesc* d) const
 		d->Add(field);
 	}
 
-HasFieldExpr::HasFieldExpr(IntrusivePtr<Expr> arg_op,
+HasFieldExpr::HasFieldExpr(zeek::IntrusivePtr<Expr> arg_op,
                            const char* arg_field_name)
 	: UnaryExpr(EXPR_HAS_FIELD, std::move(arg_op)),
 	  field_name(arg_field_name), field(0)
@@ -2949,7 +2956,7 @@ HasFieldExpr::~HasFieldExpr()
 	delete field_name;
 	}
 
-IntrusivePtr<Val> HasFieldExpr::Fold(Val* v) const
+zeek::IntrusivePtr<Val> HasFieldExpr::Fold(Val* v) const
 	{
 	auto rv = v->AsRecordVal();
 	return val_mgr->Bool(rv->GetField(field) != nullptr);
@@ -2970,7 +2977,7 @@ void HasFieldExpr::ExprDescribe(ODesc* d) const
 		d->Add(field);
 	}
 
-RecordConstructorExpr::RecordConstructorExpr(IntrusivePtr<ListExpr> constructor_list)
+RecordConstructorExpr::RecordConstructorExpr(zeek::IntrusivePtr<ListExpr> constructor_list)
 	: UnaryExpr(EXPR_RECORD_CONSTRUCTOR, std::move(constructor_list))
 	{
 	if ( IsError() )
@@ -2997,14 +3004,14 @@ RecordConstructorExpr::RecordConstructorExpr(IntrusivePtr<ListExpr> constructor_
 		record_types->push_back(new TypeDecl(field_name, field_type));
 		}
 
-	SetType(make_intrusive<RecordType>(record_types));
+	SetType(zeek::make_intrusive<RecordType>(record_types));
 	}
 
 RecordConstructorExpr::~RecordConstructorExpr()
 	{
 	}
 
-IntrusivePtr<Val> RecordConstructorExpr::InitVal(const zeek::Type* t, IntrusivePtr<Val> aggr) const
+zeek::IntrusivePtr<Val> RecordConstructorExpr::InitVal(const zeek::Type* t, zeek::IntrusivePtr<Val> aggr) const
 	{
 	auto v = Eval(nullptr);
 
@@ -3012,8 +3019,8 @@ IntrusivePtr<Val> RecordConstructorExpr::InitVal(const zeek::Type* t, IntrusiveP
 		{
 		RecordVal* rv = v->AsRecordVal();
 		auto bt = const_cast<zeek::Type*>(t);
-		IntrusivePtr<RecordType> rt{NewRef{}, bt->AsRecordType()};
-		auto aggr_rec = cast_intrusive<RecordVal>(std::move(aggr));
+		zeek::IntrusivePtr<RecordType> rt{zeek::NewRef{}, bt->AsRecordType()};
+		auto aggr_rec = zeek::cast_intrusive<RecordVal>(std::move(aggr));
 		auto ar = rv->CoerceTo(std::move(rt), std::move(aggr_rec));
 
 		if ( ar )
@@ -3024,15 +3031,15 @@ IntrusivePtr<Val> RecordConstructorExpr::InitVal(const zeek::Type* t, IntrusiveP
 	return nullptr;
 	}
 
-IntrusivePtr<Val> RecordConstructorExpr::Fold(Val* v) const
+zeek::IntrusivePtr<Val> RecordConstructorExpr::Fold(Val* v) const
 	{
 	ListVal* lv = v->AsListVal();
-	auto rt = cast_intrusive<RecordType>(type);
+	auto rt = zeek::cast_intrusive<RecordType>(type);
 
 	if ( lv->Length() != rt->NumFields() )
 		RuntimeErrorWithCallStack("inconsistency evaluating record constructor");
 
-	auto rv = make_intrusive<RecordVal>(std::move(rt));
+	auto rv = zeek::make_intrusive<RecordVal>(std::move(rt));
 
 	for ( int i = 0; i < lv->Length(); ++i )
 		rv->Assign(i, lv->Idx(i));
@@ -3047,9 +3054,9 @@ void RecordConstructorExpr::ExprDescribe(ODesc* d) const
 	d->Add("]");
 	}
 
-TableConstructorExpr::TableConstructorExpr(IntrusivePtr<ListExpr> constructor_list,
-                                           std::unique_ptr<std::vector<IntrusivePtr<Attr>>> arg_attrs,
-                                           IntrusivePtr<zeek::Type> arg_type)
+TableConstructorExpr::TableConstructorExpr(zeek::IntrusivePtr<ListExpr> constructor_list,
+                                           std::unique_ptr<std::vector<zeek::IntrusivePtr<Attr>>> arg_attrs,
+                                           zeek::IntrusivePtr<zeek::Type> arg_type)
 	: UnaryExpr(EXPR_TABLE_CONSTRUCTOR, std::move(constructor_list))
 	{
 	if ( IsError() )
@@ -3069,7 +3076,7 @@ TableConstructorExpr::TableConstructorExpr(IntrusivePtr<ListExpr> constructor_li
 	else
 		{
 		if ( op->AsListExpr()->Exprs().empty() )
-			SetType(make_intrusive<TableType>(make_intrusive<TypeList>(base_type(zeek::TYPE_ANY)), nullptr));
+			SetType(zeek::make_intrusive<TableType>(zeek::make_intrusive<TypeList>(base_type(zeek::TYPE_ANY)), nullptr));
 		else
 			{
 			SetType(init_type(op.get()));
@@ -3084,7 +3091,7 @@ TableConstructorExpr::TableConstructorExpr(IntrusivePtr<ListExpr> constructor_li
 		}
 
 	if ( arg_attrs )
-		attrs = make_intrusive<Attributes>(std::move(*arg_attrs), type, false, false);
+		attrs = zeek::make_intrusive<Attributes>(std::move(*arg_attrs), type, false, false);
 
 	const auto& indices = type->AsTableType()->GetIndices()->GetTypes();
 	const expr_list& cle = op->AsListExpr()->Exprs();
@@ -3127,12 +3134,12 @@ TableConstructorExpr::TableConstructorExpr(IntrusivePtr<ListExpr> constructor_li
 		}
 	}
 
-IntrusivePtr<Val> TableConstructorExpr::Eval(Frame* f) const
+zeek::IntrusivePtr<Val> TableConstructorExpr::Eval(Frame* f) const
 	{
 	if ( IsError() )
 		return nullptr;
 
-	auto aggr = make_intrusive<TableVal>(GetType<TableType>(), attrs);
+	auto aggr = zeek::make_intrusive<TableVal>(GetType<TableType>(), attrs);
 	const expr_list& exprs = op->AsListExpr()->Exprs();
 
 	for ( const auto& expr : exprs )
@@ -3143,7 +3150,7 @@ IntrusivePtr<Val> TableConstructorExpr::Eval(Frame* f) const
 	return aggr;
 	}
 
-IntrusivePtr<Val> TableConstructorExpr::InitVal(const zeek::Type* t, IntrusivePtr<Val> aggr) const
+zeek::IntrusivePtr<Val> TableConstructorExpr::InitVal(const zeek::Type* t, zeek::IntrusivePtr<Val> aggr) const
 	{
 	if ( IsError() )
 		return nullptr;
@@ -3151,8 +3158,8 @@ IntrusivePtr<Val> TableConstructorExpr::InitVal(const zeek::Type* t, IntrusivePt
 	auto tt = GetType<TableType>();
 
 	auto tval = aggr ?
-	        IntrusivePtr<TableVal>{AdoptRef{}, aggr.release()->AsTableVal()} :
-	        make_intrusive<TableVal>(std::move(tt), attrs);
+	        zeek::IntrusivePtr<TableVal>{zeek::AdoptRef{}, aggr.release()->AsTableVal()} :
+	        zeek::make_intrusive<TableVal>(std::move(tt), attrs);
 	const expr_list& exprs = op->AsListExpr()->Exprs();
 
 	for ( const auto& expr : exprs )
@@ -3168,9 +3175,9 @@ void TableConstructorExpr::ExprDescribe(ODesc* d) const
 	d->Add(")");
 	}
 
-SetConstructorExpr::SetConstructorExpr(IntrusivePtr<ListExpr> constructor_list,
-                                       std::unique_ptr<std::vector<IntrusivePtr<Attr>>> arg_attrs,
-                                       IntrusivePtr<zeek::Type> arg_type)
+SetConstructorExpr::SetConstructorExpr(zeek::IntrusivePtr<ListExpr> constructor_list,
+                                       std::unique_ptr<std::vector<zeek::IntrusivePtr<Attr>>> arg_attrs,
+                                       zeek::IntrusivePtr<zeek::Type> arg_type)
 	: UnaryExpr(EXPR_SET_CONSTRUCTOR, std::move(constructor_list))
 	{
 	if ( IsError() )
@@ -3190,7 +3197,7 @@ SetConstructorExpr::SetConstructorExpr(IntrusivePtr<ListExpr> constructor_list,
 	else
 		{
 		if ( op->AsListExpr()->Exprs().empty() )
-			SetType(make_intrusive<zeek::SetType>(make_intrusive<zeek::TypeList>(zeek::base_type(zeek::TYPE_ANY)), nullptr));
+			SetType(zeek::make_intrusive<zeek::SetType>(zeek::make_intrusive<zeek::TypeList>(zeek::base_type(zeek::TYPE_ANY)), nullptr));
 		else
 			SetType(init_type(op.get()));
 		}
@@ -3202,7 +3209,7 @@ SetConstructorExpr::SetConstructorExpr(IntrusivePtr<ListExpr> constructor_list,
 		SetError("values in set(...) constructor do not specify a set");
 
 	if ( arg_attrs )
-		attrs = make_intrusive<Attributes>(std::move(*arg_attrs), type, false, false);
+		attrs = zeek::make_intrusive<Attributes>(std::move(*arg_attrs), type, false, false);
 
 	const auto& indices = type->AsTableType()->GetIndices()->GetTypes();
 	expr_list& cle = op->AsListExpr()->Exprs();
@@ -3236,12 +3243,12 @@ SetConstructorExpr::SetConstructorExpr(IntrusivePtr<ListExpr> constructor_list,
 		}
 	}
 
-IntrusivePtr<Val> SetConstructorExpr::Eval(Frame* f) const
+zeek::IntrusivePtr<Val> SetConstructorExpr::Eval(Frame* f) const
 	{
 	if ( IsError() )
 		return nullptr;
 
-	auto aggr = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, type->AsTableType()},
+	auto aggr = zeek::make_intrusive<TableVal>(IntrusivePtr{zeek::NewRef{}, type->AsTableType()},
 	                                     attrs);
 	const expr_list& exprs = op->AsListExpr()->Exprs();
 
@@ -3254,7 +3261,7 @@ IntrusivePtr<Val> SetConstructorExpr::Eval(Frame* f) const
 	return aggr;
 	}
 
-IntrusivePtr<Val> SetConstructorExpr::InitVal(const zeek::Type* t, IntrusivePtr<Val> aggr) const
+zeek::IntrusivePtr<Val> SetConstructorExpr::InitVal(const zeek::Type* t, zeek::IntrusivePtr<Val> aggr) const
 	{
 	if ( IsError() )
 		return nullptr;
@@ -3262,8 +3269,8 @@ IntrusivePtr<Val> SetConstructorExpr::InitVal(const zeek::Type* t, IntrusivePtr<
 	const auto& index_type = t->AsTableType()->GetIndices();
 	auto tt = GetType<TableType>();
 	auto tval = aggr ?
-	        IntrusivePtr<TableVal>{AdoptRef{}, aggr.release()->AsTableVal()} :
-	        make_intrusive<TableVal>(std::move(tt), attrs);
+	        zeek::IntrusivePtr<TableVal>{zeek::AdoptRef{}, aggr.release()->AsTableVal()} :
+	        zeek::make_intrusive<TableVal>(std::move(tt), attrs);
 	const expr_list& exprs = op->AsListExpr()->Exprs();
 
 	for ( const auto& e : exprs )
@@ -3287,8 +3294,8 @@ void SetConstructorExpr::ExprDescribe(ODesc* d) const
 	d->Add(")");
 	}
 
-VectorConstructorExpr::VectorConstructorExpr(IntrusivePtr<ListExpr> constructor_list,
-                                             IntrusivePtr<zeek::Type> arg_type)
+VectorConstructorExpr::VectorConstructorExpr(zeek::IntrusivePtr<ListExpr> constructor_list,
+                                             zeek::IntrusivePtr<zeek::Type> arg_type)
 	: UnaryExpr(EXPR_VECTOR_CONSTRUCTOR, std::move(constructor_list))
 	{
 	if ( IsError() )
@@ -3312,12 +3319,12 @@ VectorConstructorExpr::VectorConstructorExpr(IntrusivePtr<ListExpr> constructor_
 			// vector().
 			// By default, assign VOID type here. A vector with
 			// void type set is seen as an unspecified vector.
-			SetType(make_intrusive<zeek::VectorType>(zeek::base_type(zeek::TYPE_VOID)));
+			SetType(zeek::make_intrusive<zeek::VectorType>(zeek::base_type(zeek::TYPE_VOID)));
 			return;
 			}
 
 		if ( auto t = merge_type_list(op->AsListExpr()) )
-			SetType(make_intrusive<zeek::VectorType>(std::move(t)));
+			SetType(zeek::make_intrusive<zeek::VectorType>(std::move(t)));
 		else
 			{
 			SetError();
@@ -3330,12 +3337,12 @@ VectorConstructorExpr::VectorConstructorExpr(IntrusivePtr<ListExpr> constructor_
 		ExprError("inconsistent types in vector constructor");
 	}
 
-IntrusivePtr<Val> VectorConstructorExpr::Eval(Frame* f) const
+zeek::IntrusivePtr<Val> VectorConstructorExpr::Eval(Frame* f) const
 	{
 	if ( IsError() )
 		return nullptr;
 
-	auto vec = make_intrusive<VectorVal>(GetType<zeek::VectorType>());
+	auto vec = zeek::make_intrusive<VectorVal>(GetType<zeek::VectorType>());
 	const expr_list& exprs = op->AsListExpr()->Exprs();
 
 	loop_over_list(exprs, i)
@@ -3352,15 +3359,15 @@ IntrusivePtr<Val> VectorConstructorExpr::Eval(Frame* f) const
 	return vec;
 	}
 
-IntrusivePtr<Val> VectorConstructorExpr::InitVal(const zeek::Type* t, IntrusivePtr<Val> aggr) const
+zeek::IntrusivePtr<Val> VectorConstructorExpr::InitVal(const zeek::Type* t, zeek::IntrusivePtr<Val> aggr) const
 	{
 	if ( IsError() )
 		return nullptr;
 
 	auto vt = GetType<zeek::VectorType>();
 	auto vec = aggr ?
-	        IntrusivePtr<VectorVal>{AdoptRef{}, aggr.release()->AsVectorVal()} :
-	        make_intrusive<VectorVal>(std::move(vt));
+	        zeek::IntrusivePtr<VectorVal>{zeek::AdoptRef{}, aggr.release()->AsVectorVal()} :
+	        zeek::make_intrusive<VectorVal>(std::move(vt));
 	const expr_list& exprs = op->AsListExpr()->Exprs();
 
 	loop_over_list(exprs, i)
@@ -3386,7 +3393,7 @@ void VectorConstructorExpr::ExprDescribe(ODesc* d) const
 	}
 
 FieldAssignExpr::FieldAssignExpr(const char* arg_field_name,
-                                 IntrusivePtr<Expr> value)
+                                 zeek::IntrusivePtr<Expr> value)
 	: UnaryExpr(EXPR_FIELD_ASSIGN, std::move(value)), field_name(arg_field_name)
 	{
 	SetType(op->GetType());
@@ -3432,7 +3439,7 @@ void FieldAssignExpr::ExprDescribe(ODesc* d) const
 	op->Describe(d);
 	}
 
-ArithCoerceExpr::ArithCoerceExpr(IntrusivePtr<Expr> arg_op, TypeTag t)
+ArithCoerceExpr::ArithCoerceExpr(zeek::IntrusivePtr<Expr> arg_op, TypeTag t)
 : UnaryExpr(EXPR_ARITH_COERCE, std::move(arg_op))
 	{
 	if ( IsError() )
@@ -3443,7 +3450,7 @@ ArithCoerceExpr::ArithCoerceExpr(IntrusivePtr<Expr> arg_op, TypeTag t)
 
 	if ( IsVector(bt) )
 		{
-		SetType(make_intrusive<zeek::VectorType>(zeek::base_type(t)));
+		SetType(zeek::make_intrusive<zeek::VectorType>(zeek::base_type(t)));
 		vbt = op->GetType()->AsVectorType()->Yield()->Tag();
 		}
 	else
@@ -3461,11 +3468,11 @@ ArithCoerceExpr::ArithCoerceExpr(IntrusivePtr<Expr> arg_op, TypeTag t)
 		ExprError("bad coercion value");
 	}
 
-IntrusivePtr<Val> ArithCoerceExpr::FoldSingleVal(Val* v, InternalTypeTag t) const
+zeek::IntrusivePtr<Val> ArithCoerceExpr::FoldSingleVal(Val* v, InternalTypeTag t) const
 	{
 	switch ( t ) {
 	case zeek::TYPE_INTERNAL_DOUBLE:
-		return make_intrusive<DoubleVal>(v->CoerceToDouble());
+		return zeek::make_intrusive<DoubleVal>(v->CoerceToDouble());
 
 	case zeek::TYPE_INTERNAL_INT:
 		return val_mgr->Int(v->CoerceToInt());
@@ -3479,7 +3486,7 @@ IntrusivePtr<Val> ArithCoerceExpr::FoldSingleVal(Val* v, InternalTypeTag t) cons
 	}
 	}
 
-IntrusivePtr<Val> ArithCoerceExpr::Fold(Val* v) const
+zeek::IntrusivePtr<Val> ArithCoerceExpr::Fold(Val* v) const
 	{
 	InternalTypeTag t = type->InternalType();
 
@@ -3497,7 +3504,7 @@ IntrusivePtr<Val> ArithCoerceExpr::Fold(Val* v) const
 	t = GetType()->AsVectorType()->Yield()->InternalType();
 
 	VectorVal* vv = v->AsVectorVal();
-	auto result = make_intrusive<VectorVal>(GetType<zeek::VectorType>());
+	auto result = zeek::make_intrusive<VectorVal>(GetType<zeek::VectorType>());
 
 	for ( unsigned int i = 0; i < vv->Size(); ++i )
 		{
@@ -3510,8 +3517,8 @@ IntrusivePtr<Val> ArithCoerceExpr::Fold(Val* v) const
 	return result;
 	}
 
-RecordCoerceExpr::RecordCoerceExpr(IntrusivePtr<Expr> arg_op,
-                                   IntrusivePtr<RecordType> r)
+RecordCoerceExpr::RecordCoerceExpr(zeek::IntrusivePtr<Expr> arg_op,
+                                   zeek::IntrusivePtr<RecordType> r)
 	: UnaryExpr(EXPR_RECORD_COERCE, std::move(arg_op)),
 	  map(nullptr), map_size(0)
 	{
@@ -3623,14 +3630,14 @@ RecordCoerceExpr::~RecordCoerceExpr()
 	delete [] map;
 	}
 
-IntrusivePtr<Val> RecordCoerceExpr::InitVal(const zeek::Type* t, IntrusivePtr<Val> aggr) const
+zeek::IntrusivePtr<Val> RecordCoerceExpr::InitVal(const zeek::Type* t, zeek::IntrusivePtr<Val> aggr) const
 	{
 	if ( auto v = Eval(nullptr) )
 		{
 		RecordVal* rv = v->AsRecordVal();
 		auto bt = const_cast<zeek::Type*>(t);
-		IntrusivePtr<RecordType> rt{NewRef{}, bt->AsRecordType()};
-		auto aggr_rec = cast_intrusive<RecordVal>(std::move(aggr));
+		zeek::IntrusivePtr<RecordType> rt{zeek::NewRef{}, bt->AsRecordType()};
+		auto aggr_rec = zeek::cast_intrusive<RecordVal>(std::move(aggr));
 
 		if ( auto ar = rv->CoerceTo(std::move(rt), std::move(aggr_rec)) )
 			return ar;
@@ -3640,9 +3647,9 @@ IntrusivePtr<Val> RecordCoerceExpr::InitVal(const zeek::Type* t, IntrusivePtr<Va
 	return nullptr;
 	}
 
-IntrusivePtr<Val> RecordCoerceExpr::Fold(Val* v) const
+zeek::IntrusivePtr<Val> RecordCoerceExpr::Fold(Val* v) const
 	{
-	auto val = make_intrusive<RecordVal>(GetType<RecordType>());
+	auto val = zeek::make_intrusive<RecordVal>(GetType<RecordType>());
 	RecordType* val_type = val->GetType()->AsRecordType();
 
 	RecordVal* rv = v->AsRecordVal();
@@ -3678,7 +3685,7 @@ IntrusivePtr<Val> RecordCoerceExpr::Fold(Val* v) const
 			     field_type->Tag() == zeek::TYPE_RECORD &&
 			     ! same_type(rhs_type, field_type) )
 				{
-				if ( auto new_val = rhs->AsRecordVal()->CoerceTo(cast_intrusive<RecordType>(field_type)) )
+				if ( auto new_val = rhs->AsRecordVal()->CoerceTo(zeek::cast_intrusive<RecordType>(field_type)) )
 					rhs = std::move(new_val);
 				}
 			else if ( BothArithmetic(rhs_type->Tag(), field_type->Tag()) &&
@@ -3705,7 +3712,7 @@ IntrusivePtr<Val> RecordCoerceExpr::Fold(Val* v) const
 				     ! same_type(def_type, field_type) )
 					{
 					auto tmp = def_val->AsRecordVal()->CoerceTo(
-					        cast_intrusive<RecordType>(field_type));
+					        zeek::cast_intrusive<RecordType>(field_type));
 
 					if ( tmp )
 						def_val = std::move(tmp);
@@ -3721,8 +3728,8 @@ IntrusivePtr<Val> RecordCoerceExpr::Fold(Val* v) const
 	return val;
 	}
 
-TableCoerceExpr::TableCoerceExpr(IntrusivePtr<Expr> arg_op,
-                                 IntrusivePtr<TableType> r)
+TableCoerceExpr::TableCoerceExpr(zeek::IntrusivePtr<Expr> arg_op,
+                                 zeek::IntrusivePtr<TableType> r)
 	: UnaryExpr(EXPR_TABLE_COERCE, std::move(arg_op))
 	{
 	if ( IsError() )
@@ -3742,18 +3749,18 @@ TableCoerceExpr::~TableCoerceExpr()
 	{
 	}
 
-IntrusivePtr<Val> TableCoerceExpr::Fold(Val* v) const
+zeek::IntrusivePtr<Val> TableCoerceExpr::Fold(Val* v) const
 	{
 	TableVal* tv = v->AsTableVal();
 
 	if ( tv->Size() > 0 )
 		RuntimeErrorWithCallStack("coercion of non-empty table/set");
 
-	return make_intrusive<TableVal>(GetType<TableType>(), tv->GetAttrs());
+	return zeek::make_intrusive<TableVal>(GetType<TableType>(), tv->GetAttrs());
 	}
 
-VectorCoerceExpr::VectorCoerceExpr(IntrusivePtr<Expr> arg_op,
-                                   IntrusivePtr<zeek::VectorType> v)
+VectorCoerceExpr::VectorCoerceExpr(zeek::IntrusivePtr<Expr> arg_op,
+                                   zeek::IntrusivePtr<zeek::VectorType> v)
 	: UnaryExpr(EXPR_VECTOR_COERCE, std::move(arg_op))
 	{
 	if ( IsError() )
@@ -3773,14 +3780,14 @@ VectorCoerceExpr::~VectorCoerceExpr()
 	{
 	}
 
-IntrusivePtr<Val> VectorCoerceExpr::Fold(Val* v) const
+zeek::IntrusivePtr<Val> VectorCoerceExpr::Fold(Val* v) const
 	{
 	VectorVal* vv = v->AsVectorVal();
 
 	if ( vv->Size() > 0 )
 		RuntimeErrorWithCallStack("coercion of non-empty vector");
 
-	return make_intrusive<VectorVal>(GetType<zeek::VectorType>());
+	return zeek::make_intrusive<VectorVal>(GetType<zeek::VectorType>());
 	}
 
 ScheduleTimer::ScheduleTimer(const EventHandlerPtr& arg_event, zeek::Args arg_args,
@@ -3800,8 +3807,8 @@ void ScheduleTimer::Dispatch(double /* t */, bool /* is_expire */)
 		mgr.Enqueue(event, std::move(args));
 	}
 
-ScheduleExpr::ScheduleExpr(IntrusivePtr<Expr> arg_when,
-                           IntrusivePtr<EventExpr> arg_event)
+ScheduleExpr::ScheduleExpr(zeek::IntrusivePtr<Expr> arg_when,
+                           zeek::IntrusivePtr<EventExpr> arg_event)
 	: Expr(EXPR_SCHEDULE),
 	  when(std::move(arg_when)), event(std::move(arg_event))
 	{
@@ -3821,7 +3828,7 @@ bool ScheduleExpr::IsPure() const
 	return false;
 	}
 
-IntrusivePtr<Val> ScheduleExpr::Eval(Frame* f) const
+zeek::IntrusivePtr<Val> ScheduleExpr::Eval(Frame* f) const
 	{
 	if ( terminating )
 		return nullptr;
@@ -3879,7 +3886,7 @@ void ScheduleExpr::ExprDescribe(ODesc* d) const
 		event->Describe(d);
 	}
 
-InExpr::InExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
+InExpr::InExpr(zeek::IntrusivePtr<Expr> arg_op1, zeek::IntrusivePtr<Expr> arg_op2)
 	: BinaryExpr(EXPR_IN, std::move(arg_op1), std::move(arg_op2))
 	{
 	if ( IsError() )
@@ -3945,7 +3952,7 @@ InExpr::InExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
 			}
 
 		if ( op1->Tag() != EXPR_LIST )
-			op1 = make_intrusive<ListExpr>(std::move(op1));
+			op1 = zeek::make_intrusive<ListExpr>(std::move(op1));
 
 		ListExpr* lop1 = op1->AsListExpr();
 
@@ -3956,7 +3963,7 @@ InExpr::InExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
 		}
 	}
 
-IntrusivePtr<Val> InExpr::Fold(Val* v1, Val* v2) const
+zeek::IntrusivePtr<Val> InExpr::Fold(Val* v1, Val* v2) const
 	{
 	if ( v1->GetType()->Tag() == zeek::TYPE_PATTERN )
 		{
@@ -3985,13 +3992,13 @@ IntrusivePtr<Val> InExpr::Fold(Val* v1, Val* v2) const
 	if ( is_vector(v2) )
 		res = (bool)v2->AsVectorVal()->At(v1->AsListVal()->Idx(0)->CoerceToUnsigned());
 	else
-		res = (bool)v2->AsTableVal()->Find({NewRef{}, v1});
+		res = (bool)v2->AsTableVal()->Find({zeek::NewRef{}, v1});
 
 	return val_mgr->Bool(res);
 	}
 
-CallExpr::CallExpr(IntrusivePtr<Expr> arg_func,
-                   IntrusivePtr<ListExpr> arg_args, bool in_hook)
+CallExpr::CallExpr(zeek::IntrusivePtr<Expr> arg_func,
+                   zeek::IntrusivePtr<ListExpr> arg_args, bool in_hook)
 	: Expr(EXPR_CALL), func(std::move(arg_func)), args(std::move(arg_args))
 	{
 	if ( func->IsError() || args->IsError() )
@@ -4051,7 +4058,7 @@ CallExpr::CallExpr(IntrusivePtr<Expr> arg_func,
 			SetType(yield);
 
 		// Check for call to built-ins that can be statically analyzed.
-		IntrusivePtr<Val> func_val;
+		zeek::IntrusivePtr<Val> func_val;
 
 		if ( func->Tag() == EXPR_NAME &&
 		     // This is cheating, but without it processing gets
@@ -4100,7 +4107,7 @@ bool CallExpr::IsPure() const
 	return pure;
 	}
 
-IntrusivePtr<Val> CallExpr::Eval(Frame* f) const
+zeek::IntrusivePtr<Val> CallExpr::Eval(Frame* f) const
 	{
 	if ( IsError() )
 		return nullptr;
@@ -4117,12 +4124,12 @@ IntrusivePtr<Val> CallExpr::Eval(Frame* f) const
 				DBG_LOG(DBG_NOTIFIERS,
 					"%s: provides cached function result",
 					trigger->Name());
-				return {NewRef{}, v};
+				return {zeek::NewRef{}, v};
 				}
 			}
 		}
 
-	IntrusivePtr<Val> ret;
+	zeek::IntrusivePtr<Val> ret;
 	auto func_val = func->Eval(f);
 	auto v = eval_list(f, args.get());
 
@@ -4182,7 +4189,7 @@ LambdaExpr::LambdaExpr(std::unique_ptr<function_ingredients> arg_ing,
 
 	// Install a dummy version of the function globally for use only
 	// when broker provides a closure.
-	auto dummy_func = make_intrusive<BroFunc>(
+	auto dummy_func = zeek::make_intrusive<BroFunc>(
 		ingredients->id,
 		ingredients->body,
 		ingredients->inits,
@@ -4220,7 +4227,7 @@ LambdaExpr::LambdaExpr(std::unique_ptr<function_ingredients> arg_ing,
 	// Update lamb's name
 	dummy_func->SetName(my_name.c_str());
 
-	auto v = make_intrusive<Val>(std::move(dummy_func));
+	auto v = zeek::make_intrusive<Val>(std::move(dummy_func));
 	id->SetVal(std::move(v));
 	id->SetType(ingredients->id->GetType());
 	id->SetConst();
@@ -4231,9 +4238,9 @@ Scope* LambdaExpr::GetScope() const
 	return ingredients->scope.get();
 	}
 
-IntrusivePtr<Val> LambdaExpr::Eval(Frame* f) const
+zeek::IntrusivePtr<Val> LambdaExpr::Eval(Frame* f) const
 	{
-	auto lamb = make_intrusive<BroFunc>(
+	auto lamb = zeek::make_intrusive<BroFunc>(
 		ingredients->id,
 		ingredients->body,
 		ingredients->inits,
@@ -4246,7 +4253,7 @@ IntrusivePtr<Val> LambdaExpr::Eval(Frame* f) const
 	// Allows for lookups by the receiver.
 	lamb->SetName(my_name.c_str());
 
-	return make_intrusive<Val>(std::move(lamb));
+	return zeek::make_intrusive<Val>(std::move(lamb));
 	}
 
 void LambdaExpr::ExprDescribe(ODesc* d) const
@@ -4267,7 +4274,7 @@ TraversalCode LambdaExpr::Traverse(TraversalCallback* cb) const
 	HANDLE_TC_EXPR_POST(tc);
 	}
 
-EventExpr::EventExpr(const char* arg_name, IntrusivePtr<ListExpr> arg_args)
+EventExpr::EventExpr(const char* arg_name, zeek::IntrusivePtr<ListExpr> arg_args)
 	: Expr(EXPR_EVENT), name(arg_name), args(std::move(arg_args))
 	{
 	EventHandler* h = event_registry->Lookup(name);
@@ -4309,7 +4316,7 @@ EventExpr::EventExpr(const char* arg_name, IntrusivePtr<ListExpr> arg_args)
 		}
 	}
 
-IntrusivePtr<Val> EventExpr::Eval(Frame* f) const
+zeek::IntrusivePtr<Val> EventExpr::Eval(Frame* f) const
 	{
 	if ( IsError() )
 		return nullptr;
@@ -4349,12 +4356,12 @@ void EventExpr::ExprDescribe(ODesc* d) const
 
 ListExpr::ListExpr() : Expr(EXPR_LIST)
 	{
-	SetType(make_intrusive<TypeList>());
+	SetType(zeek::make_intrusive<TypeList>());
 	}
 
-ListExpr::ListExpr(IntrusivePtr<Expr> e) : Expr(EXPR_LIST)
+ListExpr::ListExpr(zeek::IntrusivePtr<Expr> e) : Expr(EXPR_LIST)
 	{
-	SetType(make_intrusive<TypeList>());
+	SetType(zeek::make_intrusive<TypeList>());
 	Append(std::move(e));
 	}
 
@@ -4364,7 +4371,7 @@ ListExpr::~ListExpr()
 		Unref(expr);
 	}
 
-void ListExpr::Append(IntrusivePtr<Expr> e)
+void ListExpr::Append(zeek::IntrusivePtr<Expr> e)
 	{
 	exprs.push_back(e.release());
 	((TypeList*) type.get())->Append(exprs.back()->GetType());
@@ -4379,9 +4386,9 @@ bool ListExpr::IsPure() const
 	return true;
 	}
 
-IntrusivePtr<Val> ListExpr::Eval(Frame* f) const
+zeek::IntrusivePtr<Val> ListExpr::Eval(Frame* f) const
 	{
-	auto v = make_intrusive<ListVal>(zeek::TYPE_ANY);
+	auto v = zeek::make_intrusive<ListVal>(zeek::TYPE_ANY);
 
 	for ( const auto& expr : exprs )
 		{
@@ -4399,7 +4406,7 @@ IntrusivePtr<Val> ListExpr::Eval(Frame* f) const
 	return v;
 	}
 
-IntrusivePtr<zeek::Type> ListExpr::InitType() const
+zeek::IntrusivePtr<zeek::Type> ListExpr::InitType() const
 	{
 	if ( exprs.empty() )
 		{
@@ -4425,12 +4432,12 @@ IntrusivePtr<zeek::Type> ListExpr::InitType() const
 			}
 
 
-		return make_intrusive<RecordType>(types);
+		return zeek::make_intrusive<RecordType>(types);
 		}
 
 	else
 		{
-		auto tl = make_intrusive<TypeList>();
+		auto tl = zeek::make_intrusive<TypeList>();
 
 		for ( const auto& e : exprs )
 			{
@@ -4445,7 +4452,7 @@ IntrusivePtr<zeek::Type> ListExpr::InitType() const
 
 				if ( ! til->IsPure() ||
 				     ! til->AllMatch(til->GetPureType(), true) )
-					tl->Append({NewRef{}, til});
+					tl->Append({zeek::NewRef{}, til});
 				else
 					tl->Append(til->GetPureType());
 				}
@@ -4457,7 +4464,7 @@ IntrusivePtr<zeek::Type> ListExpr::InitType() const
 		}
 	}
 
-IntrusivePtr<Val> ListExpr::InitVal(const zeek::Type* t, IntrusivePtr<Val> aggr) const
+zeek::IntrusivePtr<Val> ListExpr::InitVal(const zeek::Type* t, zeek::IntrusivePtr<Val> aggr) const
 	{
 	// While fairly similar to the EvalIntoAggregate() code,
 	// we keep this separate since it also deals with initialization
@@ -4470,7 +4477,7 @@ IntrusivePtr<Val> ListExpr::InitVal(const zeek::Type* t, IntrusivePtr<Val> aggr)
 	// in which case we should expand as a ListVal.
 	if ( ! aggr && type->AsTypeList()->AllMatch(t, true) )
 		{
-		auto v = make_intrusive<ListVal>(zeek::TYPE_ANY);
+		auto v = zeek::make_intrusive<ListVal>(zeek::TYPE_ANY);
 		const auto& tl = type->AsTypeList()->GetTypes();
 
 		if ( exprs.length() != static_cast<int>(tl.size()) )
@@ -4507,7 +4514,7 @@ IntrusivePtr<Val> ListExpr::InitVal(const zeek::Type* t, IntrusivePtr<Val> aggr)
 			return nullptr;
 			}
 
-		auto v = make_intrusive<ListVal>(zeek::TYPE_ANY);
+		auto v = zeek::make_intrusive<ListVal>(zeek::TYPE_ANY);
 
 		loop_over_list(exprs, i)
 			{
@@ -4601,7 +4608,7 @@ IntrusivePtr<Val> ListExpr::InitVal(const zeek::Type* t, IntrusivePtr<Val> aggr)
 	return aggr;
 	}
 
-IntrusivePtr<Val> ListExpr::AddSetInit(const zeek::Type* t, IntrusivePtr<Val> aggr) const
+zeek::IntrusivePtr<Val> ListExpr::AddSetInit(const zeek::Type* t, zeek::IntrusivePtr<Val> aggr) const
 	{
 	if ( aggr->GetType()->Tag() != zeek::TYPE_TABLE )
 		Internal("bad aggregate in ListExpr::InitVal");
@@ -4612,7 +4619,7 @@ IntrusivePtr<Val> ListExpr::AddSetInit(const zeek::Type* t, IntrusivePtr<Val> ag
 
 	for ( const auto& expr : exprs )
 		{
-		IntrusivePtr<Val> element;
+		zeek::IntrusivePtr<Val> element;
 
 		if ( expr->GetType()->IsSet() )
 			// A set to flatten.
@@ -4667,16 +4674,16 @@ void ListExpr::ExprDescribe(ODesc* d) const
 		}
 	}
 
-IntrusivePtr<Expr> ListExpr::MakeLvalue()
+zeek::IntrusivePtr<Expr> ListExpr::MakeLvalue()
 	{
 	for ( const auto & expr : exprs )
 		if ( expr->Tag() != EXPR_NAME )
 			ExprError("can only assign to list of identifiers");
 
-	return make_intrusive<RefExpr>(IntrusivePtr{NewRef{}, this});
+	return zeek::make_intrusive<RefExpr>(IntrusivePtr{zeek::NewRef{}, this});
 	}
 
-void ListExpr::Assign(Frame* f, IntrusivePtr<Val> v)
+void ListExpr::Assign(Frame* f, zeek::IntrusivePtr<Val> v)
 	{
 	ListVal* lv = v->AsListVal();
 
@@ -4702,8 +4709,8 @@ TraversalCode ListExpr::Traverse(TraversalCallback* cb) const
 	HANDLE_TC_EXPR_POST(tc);
 	}
 
-RecordAssignExpr::RecordAssignExpr(const IntrusivePtr<Expr>& record,
-                                   const IntrusivePtr<Expr>& init_list, bool is_init)
+RecordAssignExpr::RecordAssignExpr(const zeek::IntrusivePtr<Expr>& record,
+                                   const zeek::IntrusivePtr<Expr>& init_list, bool is_init)
 	{
 	const expr_list& inits = init_list->AsListExpr()->Exprs();
 
@@ -4728,8 +4735,8 @@ RecordAssignExpr::RecordAssignExpr(const IntrusivePtr<Expr>& record,
 				if ( field >= 0 &&
 				     same_type(lhs->GetFieldType(field), t->GetFieldType(j)) )
 					{
-					auto fe_lhs = make_intrusive<FieldExpr>(record, field_name);
-					auto fe_rhs = make_intrusive<FieldExpr>(IntrusivePtr{NewRef{}, init}, field_name);
+					auto fe_lhs = zeek::make_intrusive<FieldExpr>(record, field_name);
+					auto fe_rhs = zeek::make_intrusive<FieldExpr>(IntrusivePtr{zeek::NewRef{}, init}, field_name);
 					Append(get_assign_expr(std::move(fe_lhs), std::move(fe_rhs), is_init));
 					}
 				}
@@ -4743,8 +4750,8 @@ RecordAssignExpr::RecordAssignExpr(const IntrusivePtr<Expr>& record,
 			const char* field_name = ""; // rf->FieldName();
 			if ( lhs->HasField(field_name) )
 				{
-				auto fe_lhs = make_intrusive<FieldExpr>(record, field_name);
-				IntrusivePtr<Expr> fe_rhs = {NewRef{}, rf->Op()};
+				auto fe_lhs = zeek::make_intrusive<FieldExpr>(record, field_name);
+				zeek::IntrusivePtr<Expr> fe_rhs = {zeek::NewRef{}, rf->Op()};
 				Append(get_assign_expr(std::move(fe_lhs), std::move(fe_rhs), is_init));
 				}
 			else
@@ -4764,7 +4771,7 @@ RecordAssignExpr::RecordAssignExpr(const IntrusivePtr<Expr>& record,
 		}
 	}
 
-CastExpr::CastExpr(IntrusivePtr<Expr> arg_op, IntrusivePtr<zeek::Type> t)
+CastExpr::CastExpr(zeek::IntrusivePtr<Expr> arg_op, zeek::IntrusivePtr<zeek::Type> t)
 	: UnaryExpr(EXPR_CAST, std::move(arg_op))
 	{
 	auto stype = Op()->GetType();
@@ -4775,7 +4782,7 @@ CastExpr::CastExpr(IntrusivePtr<Expr> arg_op, IntrusivePtr<zeek::Type> t)
 		ExprError("cast not supported");
 	}
 
-IntrusivePtr<Val> CastExpr::Eval(Frame* f) const
+zeek::IntrusivePtr<Val> CastExpr::Eval(Frame* f) const
 	{
 	if ( IsError() )
 		return nullptr;
@@ -4812,13 +4819,13 @@ void CastExpr::ExprDescribe(ODesc* d) const
 	GetType()->Describe(d);
 	}
 
-IsExpr::IsExpr(IntrusivePtr<Expr> arg_op, IntrusivePtr<zeek::Type> arg_t)
+IsExpr::IsExpr(zeek::IntrusivePtr<Expr> arg_op, zeek::IntrusivePtr<zeek::Type> arg_t)
 	: UnaryExpr(EXPR_IS, std::move(arg_op)), t(std::move(arg_t))
 	{
 	SetType(zeek::base_type(zeek::TYPE_BOOL));
 	}
 
-IntrusivePtr<Val> IsExpr::Fold(Val* v) const
+zeek::IntrusivePtr<Val> IsExpr::Fold(Val* v) const
 	{
 	if ( IsError() )
 		return nullptr;
@@ -4833,36 +4840,36 @@ void IsExpr::ExprDescribe(ODesc* d) const
 	t->Describe(d);
 	}
 
-IntrusivePtr<Expr> get_assign_expr(IntrusivePtr<Expr> op1,
-                                   IntrusivePtr<Expr> op2, bool is_init)
+zeek::IntrusivePtr<Expr> get_assign_expr(zeek::IntrusivePtr<Expr> op1,
+                                   zeek::IntrusivePtr<Expr> op2, bool is_init)
 	{
 	if ( op1->GetType()->Tag() == zeek::TYPE_RECORD &&
 	     op2->GetType()->Tag() == zeek::TYPE_LIST )
-		return make_intrusive<RecordAssignExpr>(std::move(op1), std::move(op2),
-		                                        is_init);
+		return zeek::make_intrusive<RecordAssignExpr>(
+			std::move(op1), std::move(op2), is_init);
 
 	else if ( op1->Tag() == EXPR_INDEX && op1->AsIndexExpr()->IsSlice() )
-		return make_intrusive<IndexSliceAssignExpr>(std::move(op1),
-		                                            std::move(op2), is_init);
+		return zeek::make_intrusive<IndexSliceAssignExpr>(
+			std::move(op1), std::move(op2), is_init);
 
 	else
-		return make_intrusive<AssignExpr>(std::move(op1), std::move(op2),
-		                                  is_init);
+		return zeek::make_intrusive<AssignExpr>(
+			std::move(op1), std::move(op2), is_init);
 	}
 
-IntrusivePtr<Expr> check_and_promote_expr(Expr* const e, zeek::Type* t)
+zeek::IntrusivePtr<Expr> check_and_promote_expr(Expr* const e, zeek::Type* t)
 	{
 	const auto& et = e->GetType();
 	TypeTag e_tag = et->Tag();
 	TypeTag t_tag = t->Tag();
 
 	if ( t->Tag() == zeek::TYPE_ANY )
-		return {NewRef{}, e};
+		return {zeek::NewRef{}, e};
 
 	if ( EitherArithmetic(t_tag, e_tag) )
 		{
 		if ( e_tag == t_tag )
-			return {NewRef{}, e};
+			return {zeek::NewRef{}, e};
 
 		if ( ! BothArithmetic(t_tag, e_tag) )
 			{
@@ -4877,7 +4884,7 @@ IntrusivePtr<Expr> check_and_promote_expr(Expr* const e, zeek::Type* t)
 			return nullptr;
 			}
 
-		return make_intrusive<ArithCoerceExpr>(IntrusivePtr{NewRef{}, e}, t_tag);
+		return zeek::make_intrusive<ArithCoerceExpr>(IntrusivePtr{zeek::NewRef{}, e}, t_tag);
 		}
 
 	if ( t->Tag() == zeek::TYPE_RECORD && et->Tag() == zeek::TYPE_RECORD )
@@ -4895,13 +4902,14 @@ IntrusivePtr<Expr> check_and_promote_expr(Expr* const e, zeek::Type* t)
 
 				if ( same_attrs(td1->attrs.get(), td2->attrs.get()) )
 					// Everything matches perfectly.
-					return {NewRef{}, e};
+					return {zeek::NewRef{}, e};
 				}
 			}
 
 		if ( record_promotion_compatible(t_r, et_r) )
-			return make_intrusive<RecordCoerceExpr>(IntrusivePtr{NewRef{}, e},
-			                                        IntrusivePtr{NewRef{}, t_r});
+			return zeek::make_intrusive<RecordCoerceExpr>(
+				IntrusivePtr{zeek::NewRef{}, e},
+				IntrusivePtr{zeek::NewRef{}, t_r});
 
 		t->Error("incompatible record types", e);
 		return nullptr;
@@ -4912,19 +4920,21 @@ IntrusivePtr<Expr> check_and_promote_expr(Expr* const e, zeek::Type* t)
 		{
 		if ( t->Tag() == zeek::TYPE_TABLE && et->Tag() == zeek::TYPE_TABLE &&
 			  et->AsTableType()->IsUnspecifiedTable() )
-			return make_intrusive<TableCoerceExpr>(IntrusivePtr{NewRef{}, e},
-			                                       IntrusivePtr{NewRef{}, t->AsTableType()});
+			return zeek::make_intrusive<TableCoerceExpr>(
+				IntrusivePtr{zeek::NewRef{}, e},
+				IntrusivePtr{zeek::NewRef{}, t->AsTableType()});
 
 		if ( t->Tag() == zeek::TYPE_VECTOR && et->Tag() == zeek::TYPE_VECTOR &&
 		     et->AsVectorType()->IsUnspecifiedVector() )
-			return make_intrusive<VectorCoerceExpr>(IntrusivePtr{NewRef{}, e},
-			                                        IntrusivePtr{NewRef{}, t->AsVectorType()});
+			return zeek::make_intrusive<VectorCoerceExpr>(
+				IntrusivePtr{zeek::NewRef{}, e},
+				IntrusivePtr{zeek::NewRef{}, t->AsVectorType()});
 
 		t->Error("type clash", e);
 		return nullptr;
 		}
 
-	return {NewRef{}, e};
+	return {zeek::NewRef{}, e};
 	}
 
 bool check_and_promote_exprs(ListExpr* const elements, TypeList* types)
@@ -5034,10 +5044,10 @@ bool check_and_promote_exprs_to_type(ListExpr* const elements, zeek::Type* type)
 	return true;
 	}
 
-std::optional<std::vector<IntrusivePtr<Val>>> eval_list(Frame* f, const ListExpr* l)
+std::optional<std::vector<zeek::IntrusivePtr<Val>>> eval_list(Frame* f, const ListExpr* l)
 	{
 	const expr_list& e = l->Exprs();
-	auto rval = std::make_optional<std::vector<IntrusivePtr<Val>>>();
+	auto rval = std::make_optional<std::vector<zeek::IntrusivePtr<Val>>>();
 	rval->reserve(e.length());
 
 	for ( const auto& expr : e )
diff --git a/src/Expr.h b/src/Expr.h
index 67fad1a9d5..25fbe5086e 100644
--- a/src/Expr.h
+++ b/src/Expr.h
@@ -78,12 +78,12 @@ public:
 	[[deprecated("Remove in v4.1.  Use GetType().")]]
 	zeek::Type* Type() const		{ return type.get(); }
 
-	const IntrusivePtr<zeek::Type>& GetType() const
+	const zeek::IntrusivePtr<zeek::Type>& GetType() const
 		{ return type; }
 
 	template <class T>
-	IntrusivePtr<T> GetType() const
-		{ return cast_intrusive<T>(type); }
+	zeek::IntrusivePtr<T> GetType() const
+		{ return zeek::cast_intrusive<T>(type); }
 
 	BroExprTag Tag() const	{ return tag; }
 
@@ -91,7 +91,7 @@ public:
 
 	// Evaluates the expression and returns a corresponding Val*,
 	// or nil if the expression's value isn't fixed.
-	virtual IntrusivePtr<Val> Eval(Frame* f) const = 0;
+	virtual zeek::IntrusivePtr<Val> Eval(Frame* f) const = 0;
 
 	// Same, but the context is that we are adding an element
 	// into the given aggregate of the given type.  Note that
@@ -101,11 +101,11 @@ public:
 			const;
 
 	// Assign to the given value, if appropriate.
-	virtual void Assign(Frame* f, IntrusivePtr<Val> v);
+	virtual void Assign(Frame* f, zeek::IntrusivePtr<Val> v);
 
 	// Returns the type corresponding to this expression interpreted
 	// as an initialization.  Returns nil if the initialization is illegal.
-	virtual IntrusivePtr<zeek::Type> InitType() const;
+	virtual zeek::IntrusivePtr<zeek::Type> InitType() const;
 
 	// Returns true if this expression, interpreted as an initialization,
 	// constitutes a record element, false otherwise.  If the TypeDecl*
@@ -118,7 +118,7 @@ public:
 	// with the given type.  If "aggr" is non-nil, then this expression
 	// is an element of the given aggregate, and it is added to it
 	// accordingly.
-	virtual IntrusivePtr<Val> InitVal(const zeek::Type* t, IntrusivePtr<Val> aggr) const;
+	virtual zeek::IntrusivePtr<Val> InitVal(const zeek::Type* t, zeek::IntrusivePtr<Val> aggr) const;
 
 	// True if the expression has no side effects, false otherwise.
 	virtual bool IsPure() const;
@@ -154,7 +154,7 @@ public:
 	// Return the expression converted to L-value form.  If expr
 	// cannot be used as an L-value, reports an error and returns
 	// the current value of expr (this is the default method).
-	virtual IntrusivePtr<Expr> MakeLvalue();
+	virtual zeek::IntrusivePtr<Expr> MakeLvalue();
 
 	// Marks the expression as one requiring (or at least appearing
 	// with) parentheses.  Used for pretty-printing.
@@ -223,7 +223,7 @@ protected:
 	// Puts the expression in canonical form.
 	virtual void Canonicize();
 
-	void SetType(IntrusivePtr<zeek::Type> t);
+	void SetType(zeek::IntrusivePtr<zeek::Type> t);
 
 	// Reports the given error and sets the expression's type to
 	// TYPE_ERROR.
@@ -235,19 +235,19 @@ protected:
 	[[noreturn]] void RuntimeErrorWithCallStack(const std::string& msg) const;
 
 	BroExprTag tag;
-	IntrusivePtr<zeek::Type> type;
+	zeek::IntrusivePtr<zeek::Type> type;
 	bool paren;
 };
 
 class NameExpr final : public Expr {
 public:
-	explicit NameExpr(IntrusivePtr<ID> id, bool const_init = false);
+	explicit NameExpr(zeek::IntrusivePtr<ID> id, bool const_init = false);
 
 	ID* Id() const		{ return id.get(); }
 
-	IntrusivePtr<Val> Eval(Frame* f) const override;
-	void Assign(Frame* f, IntrusivePtr<Val> v) override;
-	IntrusivePtr<Expr> MakeLvalue() override;
+	zeek::IntrusivePtr<Val> Eval(Frame* f) const override;
+	void Assign(Frame* f, zeek::IntrusivePtr<Val> v) override;
+	zeek::IntrusivePtr<Expr> MakeLvalue() override;
 	bool IsPure() const override;
 
 	TraversalCode Traverse(TraversalCallback* cb) const override;
@@ -255,23 +255,23 @@ public:
 protected:
 	void ExprDescribe(ODesc* d) const override;
 
-	IntrusivePtr<ID> id;
+	zeek::IntrusivePtr<ID> id;
 	bool in_const_init;
 };
 
 class ConstExpr final : public Expr {
 public:
-	explicit ConstExpr(IntrusivePtr<Val> val);
+	explicit ConstExpr(zeek::IntrusivePtr<Val> val);
 
 	Val* Value() const	{ return val.get(); }
 
-	IntrusivePtr<Val> Eval(Frame* f) const override;
+	zeek::IntrusivePtr<Val> Eval(Frame* f) const override;
 
 	TraversalCode Traverse(TraversalCallback* cb) const override;
 
 protected:
 	void ExprDescribe(ODesc* d) const override;
-	IntrusivePtr<Val> val;
+	zeek::IntrusivePtr<Val> val;
 };
 
 class UnaryExpr : public Expr {
@@ -281,21 +281,21 @@ public:
 	// UnaryExpr::Eval correctly handles vector types.  Any child
 	// class that overrides Eval() should be modified to handle
 	// vectors correctly as necessary.
-	IntrusivePtr<Val> Eval(Frame* f) const override;
+	zeek::IntrusivePtr<Val> Eval(Frame* f) const override;
 
 	bool IsPure() const override;
 
 	TraversalCode Traverse(TraversalCallback* cb) const override;
 
 protected:
-	UnaryExpr(BroExprTag arg_tag, IntrusivePtr<Expr> arg_op);
+	UnaryExpr(BroExprTag arg_tag, zeek::IntrusivePtr<Expr> arg_op);
 
 	void ExprDescribe(ODesc* d) const override;
 
 	// Returns the expression folded using the given constant.
-	virtual IntrusivePtr<Val> Fold(Val* v) const;
+	virtual zeek::IntrusivePtr<Val> Fold(Val* v) const;
 
-	IntrusivePtr<Expr> op;
+	zeek::IntrusivePtr<Expr> op;
 };
 
 class BinaryExpr : public Expr {
@@ -308,13 +308,13 @@ public:
 	// BinaryExpr::Eval correctly handles vector types.  Any child
 	// class that overrides Eval() should be modified to handle
 	// vectors correctly as necessary.
-	IntrusivePtr<Val> Eval(Frame* f) const override;
+	zeek::IntrusivePtr<Val> Eval(Frame* f) const override;
 
 	TraversalCode Traverse(TraversalCallback* cb) const override;
 
 protected:
 	BinaryExpr(BroExprTag arg_tag,
-	           IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
+	           zeek::IntrusivePtr<Expr> arg_op1, zeek::IntrusivePtr<Expr> arg_op2)
 		: Expr(arg_tag), op1(std::move(arg_op1)), op2(std::move(arg_op2))
 		{
 		if ( ! (op1 && op2) )
@@ -324,20 +324,20 @@ protected:
 		}
 
 	// Returns the expression folded using the given constants.
-	virtual IntrusivePtr<Val> Fold(Val* v1, Val* v2) const;
+	virtual zeek::IntrusivePtr<Val> Fold(Val* v1, Val* v2) const;
 
 	// Same for when the constants are strings.
-	virtual IntrusivePtr<Val> StringFold(Val* v1, Val* v2) const;
+	virtual zeek::IntrusivePtr<Val> StringFold(Val* v1, Val* v2) const;
 
 	// Same for when the constants are patterns.
-	virtual IntrusivePtr<Val> PatternFold(Val* v1, Val* v2) const;
+	virtual zeek::IntrusivePtr<Val> PatternFold(Val* v1, Val* v2) const;
 
 	// Same for when the constants are sets.
-	virtual IntrusivePtr<Val> SetFold(Val* v1, Val* v2) const;
+	virtual zeek::IntrusivePtr<Val> SetFold(Val* v1, Val* v2) const;
 
 	// Same for when the constants are addresses or subnets.
-	virtual IntrusivePtr<Val> AddrFold(Val* v1, Val* v2) const;
-	virtual IntrusivePtr<Val> SubNetFold(Val* v1, Val* v2) const;
+	virtual zeek::IntrusivePtr<Val> AddrFold(Val* v1, Val* v2) const;
+	virtual zeek::IntrusivePtr<Val> SubNetFold(Val* v1, Val* v2) const;
 
 	bool BothConst() const	{ return op1->IsConst() && op2->IsConst(); }
 
@@ -353,148 +353,148 @@ protected:
 
 	void ExprDescribe(ODesc* d) const override;
 
-	IntrusivePtr<Expr> op1;
-	IntrusivePtr<Expr> op2;
+	zeek::IntrusivePtr<Expr> op1;
+	zeek::IntrusivePtr<Expr> op2;
 };
 
 class CloneExpr final : public UnaryExpr {
 public:
-	explicit CloneExpr(IntrusivePtr<Expr> op);
-	IntrusivePtr<Val> Eval(Frame* f) const override;
+	explicit CloneExpr(zeek::IntrusivePtr<Expr> op);
+	zeek::IntrusivePtr<Val> Eval(Frame* f) const override;
 
 protected:
-	IntrusivePtr<Val> Fold(Val* v) const override;
+	zeek::IntrusivePtr<Val> Fold(Val* v) const override;
 };
 
 class IncrExpr final : public UnaryExpr {
 public:
-	IncrExpr(BroExprTag tag, IntrusivePtr<Expr> op);
+	IncrExpr(BroExprTag tag, zeek::IntrusivePtr<Expr> op);
 
-	IntrusivePtr<Val> Eval(Frame* f) const override;
-	IntrusivePtr<Val> DoSingleEval(Frame* f, Val* v) const;
+	zeek::IntrusivePtr<Val> Eval(Frame* f) const override;
+	zeek::IntrusivePtr<Val> DoSingleEval(Frame* f, Val* v) const;
 	bool IsPure() const override;
 };
 
 class ComplementExpr final : public UnaryExpr {
 public:
-	explicit ComplementExpr(IntrusivePtr<Expr> op);
+	explicit ComplementExpr(zeek::IntrusivePtr<Expr> op);
 
 protected:
-	IntrusivePtr<Val> Fold(Val* v) const override;
+	zeek::IntrusivePtr<Val> Fold(Val* v) const override;
 };
 
 class NotExpr final : public UnaryExpr {
 public:
-	explicit NotExpr(IntrusivePtr<Expr> op);
+	explicit NotExpr(zeek::IntrusivePtr<Expr> op);
 
 protected:
-	IntrusivePtr<Val> Fold(Val* v) const override;
+	zeek::IntrusivePtr<Val> Fold(Val* v) const override;
 };
 
 class PosExpr final : public UnaryExpr {
 public:
-	explicit PosExpr(IntrusivePtr<Expr> op);
+	explicit PosExpr(zeek::IntrusivePtr<Expr> op);
 
 protected:
-	IntrusivePtr<Val> Fold(Val* v) const override;
+	zeek::IntrusivePtr<Val> Fold(Val* v) const override;
 };
 
 class NegExpr final : public UnaryExpr {
 public:
-	explicit NegExpr(IntrusivePtr<Expr> op);
+	explicit NegExpr(zeek::IntrusivePtr<Expr> op);
 
 protected:
-	IntrusivePtr<Val> Fold(Val* v) const override;
+	zeek::IntrusivePtr<Val> Fold(Val* v) const override;
 };
 
 class SizeExpr final : public UnaryExpr {
 public:
-	explicit SizeExpr(IntrusivePtr<Expr> op);
-	IntrusivePtr<Val> Eval(Frame* f) const override;
+	explicit SizeExpr(zeek::IntrusivePtr<Expr> op);
+	zeek::IntrusivePtr<Val> Eval(Frame* f) const override;
 
 protected:
-	IntrusivePtr<Val> Fold(Val* v) const override;
+	zeek::IntrusivePtr<Val> Fold(Val* v) const override;
 };
 
 class AddExpr final : public BinaryExpr {
 public:
-	AddExpr(IntrusivePtr<Expr> op1, IntrusivePtr<Expr> op2);
+	AddExpr(zeek::IntrusivePtr<Expr> op1, zeek::IntrusivePtr<Expr> op2);
 	void Canonicize() override;
 };
 
 class AddToExpr final : public BinaryExpr {
 public:
-	AddToExpr(IntrusivePtr<Expr> op1, IntrusivePtr<Expr> op2);
-	IntrusivePtr<Val> Eval(Frame* f) const override;
+	AddToExpr(zeek::IntrusivePtr<Expr> op1, zeek::IntrusivePtr<Expr> op2);
+	zeek::IntrusivePtr<Val> Eval(Frame* f) const override;
 };
 
 class RemoveFromExpr final : public BinaryExpr {
 public:
-	RemoveFromExpr(IntrusivePtr<Expr> op1, IntrusivePtr<Expr> op2);
-	IntrusivePtr<Val> Eval(Frame* f) const override;
+	RemoveFromExpr(zeek::IntrusivePtr<Expr> op1, zeek::IntrusivePtr<Expr> op2);
+	zeek::IntrusivePtr<Val> Eval(Frame* f) const override;
 };
 
 class SubExpr final : public BinaryExpr {
 public:
-	SubExpr(IntrusivePtr<Expr> op1, IntrusivePtr<Expr> op2);
+	SubExpr(zeek::IntrusivePtr<Expr> op1, zeek::IntrusivePtr<Expr> op2);
 };
 
 class TimesExpr final : public BinaryExpr {
 public:
-	TimesExpr(IntrusivePtr<Expr> op1, IntrusivePtr<Expr> op2);
+	TimesExpr(zeek::IntrusivePtr<Expr> op1, zeek::IntrusivePtr<Expr> op2);
 	void Canonicize() override;
 };
 
 class DivideExpr final : public BinaryExpr {
 public:
-	DivideExpr(IntrusivePtr<Expr> op1, IntrusivePtr<Expr> op2);
+	DivideExpr(zeek::IntrusivePtr<Expr> op1, zeek::IntrusivePtr<Expr> op2);
 
 protected:
-	IntrusivePtr<Val> AddrFold(Val* v1, Val* v2) const override;
+	zeek::IntrusivePtr<Val> AddrFold(Val* v1, Val* v2) const override;
 };
 
 class ModExpr final : public BinaryExpr {
 public:
-	ModExpr(IntrusivePtr<Expr> op1, IntrusivePtr<Expr> op2);
+	ModExpr(zeek::IntrusivePtr<Expr> op1, zeek::IntrusivePtr<Expr> op2);
 };
 
 class BoolExpr final : public BinaryExpr {
 public:
-	BoolExpr(BroExprTag tag, IntrusivePtr<Expr> op1, IntrusivePtr<Expr> op2);
+	BoolExpr(BroExprTag tag, zeek::IntrusivePtr<Expr> op1, zeek::IntrusivePtr<Expr> op2);
 
-	IntrusivePtr<Val> Eval(Frame* f) const override;
-	IntrusivePtr<Val> DoSingleEval(Frame* f, IntrusivePtr<Val> v1, Expr* op2) const;
+	zeek::IntrusivePtr<Val> Eval(Frame* f) const override;
+	zeek::IntrusivePtr<Val> DoSingleEval(Frame* f, zeek::IntrusivePtr<Val> v1, Expr* op2) const;
 };
 
 class BitExpr final : public BinaryExpr {
 public:
-	BitExpr(BroExprTag tag, IntrusivePtr<Expr> op1, IntrusivePtr<Expr> op2);
+	BitExpr(BroExprTag tag, zeek::IntrusivePtr<Expr> op1, zeek::IntrusivePtr<Expr> op2);
 };
 
 class EqExpr final : public BinaryExpr {
 public:
-	EqExpr(BroExprTag tag, IntrusivePtr<Expr> op1, IntrusivePtr<Expr> op2);
+	EqExpr(BroExprTag tag, zeek::IntrusivePtr<Expr> op1, zeek::IntrusivePtr<Expr> op2);
 	void Canonicize() override;
 
 protected:
-	IntrusivePtr<Val> Fold(Val* v1, Val* v2) const override;
+	zeek::IntrusivePtr<Val> Fold(Val* v1, Val* v2) const override;
 };
 
 class RelExpr final : public BinaryExpr {
 public:
-	RelExpr(BroExprTag tag, IntrusivePtr<Expr> op1, IntrusivePtr<Expr> op2);
+	RelExpr(BroExprTag tag, zeek::IntrusivePtr<Expr> op1, zeek::IntrusivePtr<Expr> op2);
 	void Canonicize() override;
 };
 
 class CondExpr final : public Expr {
 public:
-	CondExpr(IntrusivePtr<Expr> op1, IntrusivePtr<Expr> op2, IntrusivePtr<Expr> op3);
+	CondExpr(zeek::IntrusivePtr<Expr> op1, zeek::IntrusivePtr<Expr> op2, zeek::IntrusivePtr<Expr> op3);
 
 	const Expr* Op1() const	{ return op1.get(); }
 	const Expr* Op2() const	{ return op2.get(); }
 	const Expr* Op3() const	{ return op3.get(); }
 
-	IntrusivePtr<Val> Eval(Frame* f) const override;
+	zeek::IntrusivePtr<Val> Eval(Frame* f) const override;
 	bool IsPure() const override;
 
 	TraversalCode Traverse(TraversalCallback* cb) const override;
@@ -502,53 +502,53 @@ public:
 protected:
 	void ExprDescribe(ODesc* d) const override;
 
-	IntrusivePtr<Expr> op1;
-	IntrusivePtr<Expr> op2;
-	IntrusivePtr<Expr> op3;
+	zeek::IntrusivePtr<Expr> op1;
+	zeek::IntrusivePtr<Expr> op2;
+	zeek::IntrusivePtr<Expr> op3;
 };
 
 class RefExpr final : public UnaryExpr {
 public:
-	explicit RefExpr(IntrusivePtr<Expr> op);
+	explicit RefExpr(zeek::IntrusivePtr<Expr> op);
 
-	void Assign(Frame* f, IntrusivePtr<Val> v) override;
-	IntrusivePtr<Expr> MakeLvalue() override;
+	void Assign(Frame* f, zeek::IntrusivePtr<Val> v) override;
+	zeek::IntrusivePtr<Expr> MakeLvalue() override;
 };
 
 class AssignExpr : public BinaryExpr {
 public:
 	// If val is given, evaluating this expression will always yield the val
 	// yet still perform the assignment.  Used for triggers.
-	AssignExpr(IntrusivePtr<Expr> op1, IntrusivePtr<Expr> op2, bool is_init,
-	           IntrusivePtr<Val> val = nullptr,
-	           const IntrusivePtr<Attributes>& attrs = nullptr);
+	AssignExpr(zeek::IntrusivePtr<Expr> op1, zeek::IntrusivePtr<Expr> op2, bool is_init,
+	           zeek::IntrusivePtr<Val> val = nullptr,
+	           const zeek::IntrusivePtr<Attributes>& attrs = nullptr);
 
-	IntrusivePtr<Val> Eval(Frame* f) const override;
+	zeek::IntrusivePtr<Val> Eval(Frame* f) const override;
 	void EvalIntoAggregate(const zeek::Type* t, Val* aggr, Frame* f) const override;
-	IntrusivePtr<zeek::Type> InitType() const override;
+	zeek::IntrusivePtr<zeek::Type> InitType() const override;
 	bool IsRecordElement(TypeDecl* td) const override;
-	IntrusivePtr<Val> InitVal(const zeek::Type* t, IntrusivePtr<Val> aggr) const override;
+	zeek::IntrusivePtr<Val> InitVal(const zeek::Type* t, zeek::IntrusivePtr<Val> aggr) const override;
 	bool IsPure() const override;
 
 protected:
-	bool TypeCheck(const IntrusivePtr<Attributes>& attrs = nullptr);
+	bool TypeCheck(const zeek::IntrusivePtr<Attributes>& attrs = nullptr);
 	bool TypeCheckArithmetics(TypeTag bt1, TypeTag bt2);
 
 	bool is_init;
-	IntrusivePtr<Val> val;	// optional
+	zeek::IntrusivePtr<Val> val;	// optional
 };
 
 class IndexSliceAssignExpr final : public AssignExpr {
 public:
-	IndexSliceAssignExpr(IntrusivePtr<Expr> op1,
-	                     IntrusivePtr<Expr> op2, bool is_init);
-	IntrusivePtr<Val> Eval(Frame* f) const override;
+	IndexSliceAssignExpr(zeek::IntrusivePtr<Expr> op1,
+	                     zeek::IntrusivePtr<Expr> op2, bool is_init);
+	zeek::IntrusivePtr<Val> Eval(Frame* f) const override;
 };
 
 class IndexExpr final : public BinaryExpr {
 public:
-	IndexExpr(IntrusivePtr<Expr> op1,
-	          IntrusivePtr<ListExpr> op2, bool is_slice = false);
+	IndexExpr(zeek::IntrusivePtr<Expr> op1,
+	          zeek::IntrusivePtr<ListExpr> op2, bool is_slice = false);
 
 	bool CanAdd() const override;
 	bool CanDel() const override;
@@ -556,19 +556,19 @@ public:
 	void Add(Frame* f) override;
 	void Delete(Frame* f) override;
 
-	void Assign(Frame* f, IntrusivePtr<Val> v) override;
-	IntrusivePtr<Expr> MakeLvalue() override;
+	void Assign(Frame* f, zeek::IntrusivePtr<Val> v) override;
+	zeek::IntrusivePtr<Expr> MakeLvalue() override;
 
 	// Need to override Eval since it can take a vector arg but does
 	// not necessarily return a vector.
-	IntrusivePtr<Val> Eval(Frame* f) const override;
+	zeek::IntrusivePtr<Val> Eval(Frame* f) const override;
 
 	TraversalCode Traverse(TraversalCallback* cb) const override;
 
 	bool IsSlice() const { return is_slice; }
 
 protected:
-	IntrusivePtr<Val> Fold(Val* v1, Val* v2) const override;
+	zeek::IntrusivePtr<Val> Fold(Val* v1, Val* v2) const override;
 
 	void ExprDescribe(ODesc* d) const override;
 
@@ -577,7 +577,7 @@ protected:
 
 class FieldExpr final : public UnaryExpr {
 public:
-	FieldExpr(IntrusivePtr<Expr> op, const char* field_name);
+	FieldExpr(zeek::IntrusivePtr<Expr> op, const char* field_name);
 	~FieldExpr() override;
 
 	int Field() const	{ return field; }
@@ -585,13 +585,13 @@ public:
 
 	bool CanDel() const override;
 
-	void Assign(Frame* f, IntrusivePtr<Val> v) override;
+	void Assign(Frame* f, zeek::IntrusivePtr<Val> v) override;
 	void Delete(Frame* f) override;
 
-	IntrusivePtr<Expr> MakeLvalue() override;
+	zeek::IntrusivePtr<Expr> MakeLvalue() override;
 
 protected:
-	IntrusivePtr<Val> Fold(Val* v) const override;
+	zeek::IntrusivePtr<Val> Fold(Val* v) const override;
 
 	void ExprDescribe(ODesc* d) const override;
 
@@ -604,13 +604,13 @@ protected:
 // "rec?$$attrname" is true if the attribute attrname is not nil.
 class HasFieldExpr final : public UnaryExpr {
 public:
-	HasFieldExpr(IntrusivePtr<Expr> op, const char* field_name);
+	HasFieldExpr(zeek::IntrusivePtr<Expr> op, const char* field_name);
 	~HasFieldExpr() override;
 
 	const char* FieldName() const	{ return field_name; }
 
 protected:
-	IntrusivePtr<Val> Fold(Val* v) const override;
+	zeek::IntrusivePtr<Val> Fold(Val* v) const override;
 
 	void ExprDescribe(ODesc* d) const override;
 
@@ -620,76 +620,76 @@ protected:
 
 class RecordConstructorExpr final : public UnaryExpr {
 public:
-	explicit RecordConstructorExpr(IntrusivePtr<ListExpr> constructor_list);
+	explicit RecordConstructorExpr(zeek::IntrusivePtr<ListExpr> constructor_list);
 	~RecordConstructorExpr() override;
 
 protected:
-	IntrusivePtr<Val> InitVal(const zeek::Type* t, IntrusivePtr<Val> aggr) const override;
-	IntrusivePtr<Val> Fold(Val* v) const override;
+	zeek::IntrusivePtr<Val> InitVal(const zeek::Type* t, zeek::IntrusivePtr<Val> aggr) const override;
+	zeek::IntrusivePtr<Val> Fold(Val* v) const override;
 
 	void ExprDescribe(ODesc* d) const override;
 };
 
 class TableConstructorExpr final : public UnaryExpr {
 public:
-	TableConstructorExpr(IntrusivePtr<ListExpr> constructor_list,
-	                     std::unique_ptr<std::vector<IntrusivePtr<Attr>>> attrs,
-	                     IntrusivePtr<zeek::Type> arg_type = nullptr);
+	TableConstructorExpr(zeek::IntrusivePtr<ListExpr> constructor_list,
+	                     std::unique_ptr<std::vector<zeek::IntrusivePtr<Attr>>> attrs,
+	                     zeek::IntrusivePtr<zeek::Type> arg_type = nullptr);
 
 	[[deprecated("Remove in v4.1.  Use GetAttrs().")]]
 	Attributes* Attrs() { return attrs.get(); }
 
-	const IntrusivePtr<Attributes>& GetAttrs() const
+	const zeek::IntrusivePtr<Attributes>& GetAttrs() const
 		{ return attrs; }
 
-	IntrusivePtr<Val> Eval(Frame* f) const override;
+	zeek::IntrusivePtr<Val> Eval(Frame* f) const override;
 
 protected:
-	IntrusivePtr<Val> InitVal(const zeek::Type* t, IntrusivePtr<Val> aggr) const override;
+	zeek::IntrusivePtr<Val> InitVal(const zeek::Type* t, zeek::IntrusivePtr<Val> aggr) const override;
 
 	void ExprDescribe(ODesc* d) const override;
 
-	IntrusivePtr<Attributes> attrs;
+	zeek::IntrusivePtr<Attributes> attrs;
 };
 
 class SetConstructorExpr final : public UnaryExpr {
 public:
-	SetConstructorExpr(IntrusivePtr<ListExpr> constructor_list,
-	                   std::unique_ptr<std::vector<IntrusivePtr<Attr>>> attrs,
-	                   IntrusivePtr<zeek::Type> arg_type = nullptr);
+	SetConstructorExpr(zeek::IntrusivePtr<ListExpr> constructor_list,
+	                   std::unique_ptr<std::vector<zeek::IntrusivePtr<Attr>>> attrs,
+	                   zeek::IntrusivePtr<zeek::Type> arg_type = nullptr);
 
 	[[deprecated("Remove in v4.1.  Use GetAttrs().")]]
 	Attributes* Attrs() { return attrs.get(); }
 
-	const IntrusivePtr<Attributes>& GetAttrs() const
+	const zeek::IntrusivePtr<Attributes>& GetAttrs() const
 		{ return attrs; }
 
-	IntrusivePtr<Val> Eval(Frame* f) const override;
+	zeek::IntrusivePtr<Val> Eval(Frame* f) const override;
 
 protected:
-	IntrusivePtr<Val> InitVal(const zeek::Type* t, IntrusivePtr<Val> aggr) const override;
+	zeek::IntrusivePtr<Val> InitVal(const zeek::Type* t, zeek::IntrusivePtr<Val> aggr) const override;
 
 	void ExprDescribe(ODesc* d) const override;
 
-	IntrusivePtr<Attributes> attrs;
+	zeek::IntrusivePtr<Attributes> attrs;
 };
 
 class VectorConstructorExpr final : public UnaryExpr {
 public:
-	explicit VectorConstructorExpr(IntrusivePtr<ListExpr> constructor_list,
-	                               IntrusivePtr<zeek::Type> arg_type = nullptr);
+	explicit VectorConstructorExpr(zeek::IntrusivePtr<ListExpr> constructor_list,
+	                               zeek::IntrusivePtr<zeek::Type> arg_type = nullptr);
 
-	IntrusivePtr<Val> Eval(Frame* f) const override;
+	zeek::IntrusivePtr<Val> Eval(Frame* f) const override;
 
 protected:
-	IntrusivePtr<Val> InitVal(const zeek::Type* t, IntrusivePtr<Val> aggr) const override;
+	zeek::IntrusivePtr<Val> InitVal(const zeek::Type* t, zeek::IntrusivePtr<Val> aggr) const override;
 
 	void ExprDescribe(ODesc* d) const override;
 };
 
 class FieldAssignExpr final : public UnaryExpr {
 public:
-	FieldAssignExpr(const char* field_name, IntrusivePtr<Expr> value);
+	FieldAssignExpr(const char* field_name, zeek::IntrusivePtr<Expr> value);
 
 	const char* FieldName() const	{ return field_name.c_str(); }
 
@@ -704,21 +704,21 @@ protected:
 
 class ArithCoerceExpr final : public UnaryExpr {
 public:
-	ArithCoerceExpr(IntrusivePtr<Expr> op, zeek::TypeTag t);
+	ArithCoerceExpr(zeek::IntrusivePtr<Expr> op, zeek::TypeTag t);
 
 protected:
-	IntrusivePtr<Val> FoldSingleVal(Val* v, InternalTypeTag t) const;
-	IntrusivePtr<Val> Fold(Val* v) const override;
+	zeek::IntrusivePtr<Val> FoldSingleVal(Val* v, InternalTypeTag t) const;
+	zeek::IntrusivePtr<Val> Fold(Val* v) const override;
 };
 
 class RecordCoerceExpr final : public UnaryExpr {
 public:
-	RecordCoerceExpr(IntrusivePtr<Expr> op, IntrusivePtr<RecordType> r);
+	RecordCoerceExpr(zeek::IntrusivePtr<Expr> op, zeek::IntrusivePtr<RecordType> r);
 	~RecordCoerceExpr() override;
 
 protected:
-	IntrusivePtr<Val> InitVal(const zeek::Type* t, IntrusivePtr<Val> aggr) const override;
-	IntrusivePtr<Val> Fold(Val* v) const override;
+	zeek::IntrusivePtr<Val> InitVal(const zeek::Type* t, zeek::IntrusivePtr<Val> aggr) const override;
+	zeek::IntrusivePtr<Val> Fold(Val* v) const override;
 
 	// For each super-record slot, gives subrecord slot with which to
 	// fill it.
@@ -728,20 +728,20 @@ protected:
 
 class TableCoerceExpr final : public UnaryExpr {
 public:
-	TableCoerceExpr(IntrusivePtr<Expr> op, IntrusivePtr<TableType> r);
+	TableCoerceExpr(zeek::IntrusivePtr<Expr> op, zeek::IntrusivePtr<TableType> r);
 	~TableCoerceExpr() override;
 
 protected:
-	IntrusivePtr<Val> Fold(Val* v) const override;
+	zeek::IntrusivePtr<Val> Fold(Val* v) const override;
 };
 
 class VectorCoerceExpr final : public UnaryExpr {
 public:
-	VectorCoerceExpr(IntrusivePtr<Expr> op, IntrusivePtr<VectorType> v);
+	VectorCoerceExpr(zeek::IntrusivePtr<Expr> op, zeek::IntrusivePtr<VectorType> v);
 	~VectorCoerceExpr() override;
 
 protected:
-	IntrusivePtr<Val> Fold(Val* v) const override;
+	zeek::IntrusivePtr<Val> Fold(Val* v) const override;
 };
 
 class ScheduleTimer final : public Timer {
@@ -758,11 +758,11 @@ protected:
 
 class ScheduleExpr final : public Expr {
 public:
-	ScheduleExpr(IntrusivePtr<Expr> when, IntrusivePtr<EventExpr> event);
+	ScheduleExpr(zeek::IntrusivePtr<Expr> when, zeek::IntrusivePtr<EventExpr> event);
 
 	bool IsPure() const override;
 
-	IntrusivePtr<Val> Eval(Frame* f) const override;
+	zeek::IntrusivePtr<Val> Eval(Frame* f) const override;
 
 	Expr* When() const	{ return when.get(); }
 	EventExpr* Event() const	{ return event.get(); }
@@ -772,22 +772,22 @@ public:
 protected:
 	void ExprDescribe(ODesc* d) const override;
 
-	IntrusivePtr<Expr> when;
-	IntrusivePtr<EventExpr> event;
+	zeek::IntrusivePtr<Expr> when;
+	zeek::IntrusivePtr<EventExpr> event;
 };
 
 class InExpr final : public BinaryExpr {
 public:
-	InExpr(IntrusivePtr<Expr> op1, IntrusivePtr<Expr> op2);
+	InExpr(zeek::IntrusivePtr<Expr> op1, zeek::IntrusivePtr<Expr> op2);
 
 protected:
-	IntrusivePtr<Val> Fold(Val* v1, Val* v2) const override;
+	zeek::IntrusivePtr<Val> Fold(Val* v1, Val* v2) const override;
 
 };
 
 class CallExpr final : public Expr {
 public:
-	CallExpr(IntrusivePtr<Expr> func, IntrusivePtr<ListExpr> args,
+	CallExpr(zeek::IntrusivePtr<Expr> func, zeek::IntrusivePtr<ListExpr> args,
 	         bool in_hook = false);
 
 	Expr* Func() const	{ return func.get(); }
@@ -795,15 +795,15 @@ public:
 
 	bool IsPure() const override;
 
-	IntrusivePtr<Val> Eval(Frame* f) const override;
+	zeek::IntrusivePtr<Val> Eval(Frame* f) const override;
 
 	TraversalCode Traverse(TraversalCallback* cb) const override;
 
 protected:
 	void ExprDescribe(ODesc* d) const override;
 
-	IntrusivePtr<Expr> func;
-	IntrusivePtr<ListExpr> args;
+	zeek::IntrusivePtr<Expr> func;
+	zeek::IntrusivePtr<ListExpr> args;
 };
 
 
@@ -817,7 +817,7 @@ public:
 	LambdaExpr(std::unique_ptr<function_ingredients> ingredients,
 		   id_list outer_ids);
 
-	IntrusivePtr<Val> Eval(Frame* f) const override;
+	zeek::IntrusivePtr<Val> Eval(Frame* f) const override;
 	TraversalCode Traverse(TraversalCallback* cb) const override;
 
 	Scope* GetScope() const;
@@ -834,13 +834,13 @@ private:
 
 class EventExpr final : public Expr {
 public:
-	EventExpr(const char* name, IntrusivePtr<ListExpr> args);
+	EventExpr(const char* name, zeek::IntrusivePtr<ListExpr> args);
 
 	const char* Name() const	{ return name.c_str(); }
 	ListExpr* Args() const		{ return args.get(); }
 	EventHandlerPtr Handler()  const	{ return handler; }
 
-	IntrusivePtr<Val> Eval(Frame* f) const override;
+	zeek::IntrusivePtr<Val> Eval(Frame* f) const override;
 
 	TraversalCode Traverse(TraversalCallback* cb) const override;
 
@@ -849,16 +849,16 @@ protected:
 
 	std::string name;
 	EventHandlerPtr handler;
-	IntrusivePtr<ListExpr> args;
+	zeek::IntrusivePtr<ListExpr> args;
 };
 
 class ListExpr : public Expr {
 public:
 	ListExpr();
-	explicit ListExpr(IntrusivePtr<Expr> e);
+	explicit ListExpr(zeek::IntrusivePtr<Expr> e);
 	~ListExpr() override;
 
-	void Append(IntrusivePtr<Expr> e);
+	void Append(zeek::IntrusivePtr<Expr> e);
 
 	const expr_list& Exprs() const	{ return exprs; }
 	expr_list& Exprs()		{ return exprs; }
@@ -866,17 +866,17 @@ public:
 	// True if the entire list represents pure values.
 	bool IsPure() const override;
 
-	IntrusivePtr<Val> Eval(Frame* f) const override;
+	zeek::IntrusivePtr<Val> Eval(Frame* f) const override;
 
-	IntrusivePtr<zeek::Type> InitType() const override;
-	IntrusivePtr<Val> InitVal(const zeek::Type* t, IntrusivePtr<Val> aggr) const override;
-	IntrusivePtr<Expr> MakeLvalue() override;
-	void Assign(Frame* f, IntrusivePtr<Val> v) override;
+	zeek::IntrusivePtr<zeek::Type> InitType() const override;
+	zeek::IntrusivePtr<Val> InitVal(const zeek::Type* t, zeek::IntrusivePtr<Val> aggr) const override;
+	zeek::IntrusivePtr<Expr> MakeLvalue() override;
+	void Assign(Frame* f, zeek::IntrusivePtr<Val> v) override;
 
 	TraversalCode Traverse(TraversalCallback* cb) const override;
 
 protected:
-	IntrusivePtr<Val> AddSetInit(const zeek::Type* t, IntrusivePtr<Val> aggr) const;
+	zeek::IntrusivePtr<Val> AddSetInit(const zeek::Type* t, zeek::IntrusivePtr<Val> aggr) const;
 
 	void ExprDescribe(ODesc* d) const override;
 
@@ -886,28 +886,28 @@ protected:
 
 class RecordAssignExpr final : public ListExpr {
 public:
-	RecordAssignExpr(const IntrusivePtr<Expr>& record, const IntrusivePtr<Expr>& init_list, bool is_init);
+	RecordAssignExpr(const zeek::IntrusivePtr<Expr>& record, const zeek::IntrusivePtr<Expr>& init_list, bool is_init);
 };
 
 class CastExpr final : public UnaryExpr {
 public:
-	CastExpr(IntrusivePtr<Expr> op, IntrusivePtr<zeek::Type> t);
+	CastExpr(zeek::IntrusivePtr<Expr> op, zeek::IntrusivePtr<zeek::Type> t);
 
 protected:
-	IntrusivePtr<Val> Eval(Frame* f) const override;
+	zeek::IntrusivePtr<Val> Eval(Frame* f) const override;
 	void ExprDescribe(ODesc* d) const override;
 };
 
 class IsExpr final : public UnaryExpr {
 public:
-	IsExpr(IntrusivePtr<Expr> op, IntrusivePtr<zeek::Type> t);
+	IsExpr(zeek::IntrusivePtr<Expr> op, zeek::IntrusivePtr<zeek::Type> t);
 
 protected:
-	IntrusivePtr<Val> Fold(Val* v) const override;
+	zeek::IntrusivePtr<Val> Fold(Val* v) const override;
 	void ExprDescribe(ODesc* d) const override;
 
 private:
-	IntrusivePtr<zeek::Type> t;
+	zeek::IntrusivePtr<zeek::Type> t;
 };
 
 inline Val* Expr::ExprVal() const
@@ -918,8 +918,9 @@ inline Val* Expr::ExprVal() const
 	}
 
 // Decides whether to return an AssignExpr or a RecordAssignExpr.
-IntrusivePtr<Expr> get_assign_expr(IntrusivePtr<Expr> op1,
-                                   IntrusivePtr<Expr> op2, bool is_init);
+zeek::IntrusivePtr<Expr> get_assign_expr(
+	zeek::IntrusivePtr<Expr> op1,
+	zeek::IntrusivePtr<Expr> op2, bool is_init);
 
 // Type-check the given expression(s) against the given type(s).  Complain
 // if the expression cannot match the given type, returning 0.  If it can
@@ -936,7 +937,7 @@ IntrusivePtr<Expr> get_assign_expr(IntrusivePtr<Expr> op1,
  * Returns nullptr if the expression cannot match or a promoted
  * expression.
  */
-extern IntrusivePtr<Expr> check_and_promote_expr(Expr* e, Type* t);
+extern zeek::IntrusivePtr<Expr> check_and_promote_expr(Expr* e, Type* t);
 
 extern bool check_and_promote_exprs(ListExpr* elements, TypeList* types);
 extern bool check_and_promote_args(ListExpr* args, RecordType* types);
@@ -944,7 +945,7 @@ extern bool check_and_promote_exprs_to_type(ListExpr* elements, Type* type);
 
 // Returns a ListExpr simplified down to a list a values, or nil
 // if they couldn't all be reduced.
-std::optional<std::vector<IntrusivePtr<Val>>> eval_list(Frame* f, const ListExpr* l);
+std::optional<std::vector<zeek::IntrusivePtr<Val>>> eval_list(Frame* f, const ListExpr* l);
 
 // Returns true if e1 is "greater" than e2 - here "greater" is just
 // a heuristic, used with commutative operators to put them into
@@ -953,7 +954,7 @@ extern bool expr_greater(const Expr* e1, const Expr* e2);
 
 // True if the given Expr* has a vector type
 inline bool is_vector(Expr* e)	{ return e->GetType()->Tag() == TYPE_VECTOR; }
-inline bool is_vector(const IntrusivePtr<Expr>& e)	{ return is_vector(e.get()); }
+inline bool is_vector(const zeek::IntrusivePtr<Expr>& e)	{ return is_vector(e.get()); }
 
 }
 
diff --git a/src/File.cc b/src/File.cc
index f5c25b9b96..bf3cc294f2 100644
--- a/src/File.cc
+++ b/src/File.cc
@@ -328,8 +328,8 @@ void BroFile::RaiseOpenEvent()
 	if ( ! ::file_opened )
 		return;
 
-	IntrusivePtr<BroFile> bf{NewRef{}, this};
-	Event* event = new ::Event(::file_opened, {make_intrusive<Val>(std::move(bf))});
+	zeek::IntrusivePtr<BroFile> bf{zeek::NewRef{}, this};
+	Event* event = new ::Event(::file_opened, {zeek::make_intrusive<Val>(std::move(bf))});
 	mgr.Dispatch(event, true);
 	}
 
@@ -346,11 +346,11 @@ double BroFile::Size()
 	return s.st_size;
 	}
 
-IntrusivePtr<BroFile> BroFile::Get(const char* name)
+zeek::IntrusivePtr<BroFile> BroFile::Get(const char* name)
 	{
 	for ( const auto &el : open_files )
 		if ( el.first == name )
-			return {NewRef{}, el.second};
+			return {zeek::NewRef{}, el.second};
 
-	return make_intrusive<BroFile>(name, "w");
+	return zeek::make_intrusive<BroFile>(name, "w");
 	}
diff --git a/src/File.h b/src/File.h
index 8e57572a63..a3c834a116 100644
--- a/src/File.h
+++ b/src/File.h
@@ -45,7 +45,7 @@ public:
 	[[deprecated("Remove in v4.1.  Use GetType().")]]
 	zeek::Type* FType() const	{ return t.get(); }
 
-	const IntrusivePtr<zeek::Type>& GetType() const
+	const zeek::IntrusivePtr<zeek::Type>& GetType() const
 		{ return t; }
 
 	// Whether the file is open in a general sense; it might
@@ -72,7 +72,7 @@ public:
 	static void CloseOpenFiles();
 
 	// Get the file with the given name, opening it if it doesn't yet exist.
-	static IntrusivePtr<BroFile> Get(const char* name);
+	static zeek::IntrusivePtr<BroFile> Get(const char* name);
 	[[deprecated("Remove in v4.1.  Use BroFile::Get().")]]
 	static BroFile* GetFile(const char* name)
 		{ return Get(name).release(); }
@@ -106,7 +106,7 @@ protected:
 	void RaiseOpenEvent();
 
 	FILE* f;
-	IntrusivePtr<zeek::Type> t;
+	zeek::IntrusivePtr<zeek::Type> t;
 	char* name;
 	char* access;
 	zeek::detail::Attributes* attrs;
diff --git a/src/Frame.cc b/src/Frame.cc
index 6962b1aa0e..6692b4e012 100644
--- a/src/Frame.cc
+++ b/src/Frame.cc
@@ -63,9 +63,9 @@ void Frame::AddFunctionWithClosureRef(BroFunc* func)
 	}
 
 void Frame::SetElement(int n, Val* v)
-	{ SetElement(n, {AdoptRef{}, v}); }
+	{ SetElement(n, {zeek::AdoptRef{}, v}); }
 
-void Frame::SetElement(int n, IntrusivePtr<Val> v)
+void Frame::SetElement(int n, zeek::IntrusivePtr<Val> v)
 	{
 	ClearElement(n);
 	frame[n] = {std::move(v), false};
@@ -74,10 +74,10 @@ void Frame::SetElement(int n, IntrusivePtr<Val> v)
 void Frame::SetElementWeak(int n, Val* v)
 	{
 	ClearElement(n);
-	frame[n] = {{AdoptRef{}, v}, true};
+	frame[n] = {{zeek::AdoptRef{}, v}, true};
 	}
 
-void Frame::SetElement(const zeek::detail::ID* id, IntrusivePtr<Val> v)
+void Frame::SetElement(const zeek::detail::ID* id, zeek::IntrusivePtr<Val> v)
 	{
 	if ( closure )
 		{
@@ -106,7 +106,7 @@ void Frame::SetElement(const zeek::detail::ID* id, IntrusivePtr<Val> v)
 	SetElement(id->Offset(), std::move(v));
 	}
 
-const IntrusivePtr<Val>& Frame::GetElementByID(const zeek::detail::ID* id) const
+const zeek::IntrusivePtr<Val>& Frame::GetElementByID(const zeek::detail::ID* id) const
 	{
 	if ( closure )
 		{
@@ -173,7 +173,7 @@ Frame* Frame::Clone() const
 	return other;
 	}
 
-static bool val_is_func(const IntrusivePtr<Val>& v, BroFunc* func)
+static bool val_is_func(const zeek::IntrusivePtr<Val>& v, BroFunc* func)
 	{
 	if ( v->GetType()->Tag() != zeek::TYPE_FUNC )
 		return false;
@@ -348,14 +348,14 @@ broker::expected<broker::data> Frame::Serialize(const Frame* target, const id_li
 	return {std::move(rval)};
 	}
 
-std::pair<bool, IntrusivePtr<Frame>> Frame::Unserialize(const broker::vector& data)
+std::pair<bool, zeek::IntrusivePtr<Frame>> Frame::Unserialize(const broker::vector& data)
 	{
 	if ( data.size() == 0 )
 		return std::make_pair(true, nullptr);
 
 	id_list outer_ids;
 	OffsetMap offset_map;
-	IntrusivePtr<Frame> closure;
+	zeek::IntrusivePtr<Frame> closure;
 
 	auto where = data.begin();
 
@@ -437,7 +437,7 @@ std::pair<bool, IntrusivePtr<Frame>> Frame::Unserialize(const broker::vector& da
 	int frame_size = body.size();
 
 	// We'll associate this frame with a function later.
-	auto rf = make_intrusive<Frame>(frame_size, nullptr, nullptr);
+	auto rf = zeek::make_intrusive<Frame>(frame_size, nullptr, nullptr);
 	rf->offset_map = std::make_unique<OffsetMap>(std::move(offset_map));
 
 	// Frame takes ownership of unref'ing elements in outer_ids
@@ -505,7 +505,7 @@ void Frame::CaptureClosure(Frame* c, id_list arg_outer_ids)
 	// if (c) closure = c->SelectiveClone(outer_ids);
 	}
 
-void Frame::SetTrigger(IntrusivePtr<zeek::detail::trigger::Trigger> arg_trigger)
+void Frame::SetTrigger(zeek::IntrusivePtr<zeek::detail::trigger::Trigger> arg_trigger)
 	{
 	trigger = std::move(arg_trigger);
 	}
diff --git a/src/Frame.h b/src/Frame.h
index 248e8e8f04..87720c6bc8 100644
--- a/src/Frame.h
+++ b/src/Frame.h
@@ -43,7 +43,7 @@ public:
 	 * @param n the index to get.
 	 * @return the value at index *n* of the underlying array.
 	 */
-	const IntrusivePtr<Val>& GetElement(int n) const
+	const zeek::IntrusivePtr<Val>& GetElement(int n) const
 		{ return frame[n].val; }
 
 	[[deprecated("Remove in v4.1.  Use GetElement(int).")]]
@@ -54,7 +54,7 @@ public:
 	 * @param n the index to set
 	 * @param v the value to set it to
 	 */
-	void SetElement(int n, IntrusivePtr<Val> v);
+	void SetElement(int n, zeek::IntrusivePtr<Val> v);
 
 	[[deprecated("Remove in v4.1.  Pass IntrusivePtr instead.")]]
 	void SetElement(int n, Val* v);
@@ -66,8 +66,8 @@ public:
 	 * @param id the ID to associate
 	 * @param v the value to associate it with
 	 */
-	void SetElement(const zeek::detail::ID* id, IntrusivePtr<Val> v);
-	void SetElement(const IntrusivePtr<zeek::detail::ID>& id, IntrusivePtr<Val> v)
+	void SetElement(const zeek::detail::ID* id, zeek::IntrusivePtr<Val> v);
+	void SetElement(const zeek::IntrusivePtr<zeek::detail::ID>& id, zeek::IntrusivePtr<Val> v)
 		{ SetElement(id.get(), std::move(v)); }
 
 	/**
@@ -77,7 +77,7 @@ public:
 	 * @param id the id who's value to retreive
 	 * @return the value associated with *id*
 	 */
-	const IntrusivePtr<Val>& GetElementByID(const IntrusivePtr<zeek::detail::ID>& id) const
+	const zeek::IntrusivePtr<Val>& GetElementByID(const zeek::IntrusivePtr<zeek::detail::ID>& id) const
 		{ return GetElementByID(id.get()); }
 
 	[[deprecated("Remove in v4.1.  Use GetElementByID().")]]
@@ -195,7 +195,7 @@ public:
 	 * and the second is the unserialized frame with reference count +1, or
 	 * null if the serialization wasn't successful.
 	 */
-	static std::pair<bool, IntrusivePtr<Frame>> Unserialize(const broker::vector& data);
+	static std::pair<bool, zeek::IntrusivePtr<Frame>> Unserialize(const broker::vector& data);
 
 	/**
 	 * Sets the IDs that the frame knows offsets for. These offsets will
@@ -216,7 +216,7 @@ public:
 
 	// If the frame is run in the context of a trigger condition evaluation,
 	// the trigger needs to be registered.
-	void SetTrigger(IntrusivePtr<zeek::detail::trigger::Trigger> arg_trigger);
+	void SetTrigger(zeek::IntrusivePtr<zeek::detail::trigger::Trigger> arg_trigger);
 	void ClearTrigger();
 	zeek::detail::trigger::Trigger* GetTrigger() const		{ return trigger.get(); }
 
@@ -241,13 +241,13 @@ private:
 	using OffsetMap = std::unordered_map<std::string, int>;
 
 	struct Element {
-		IntrusivePtr<Val> val;
+		zeek::IntrusivePtr<Val> val;
 		// Weak reference is used to prevent circular reference memory leaks
 		// in lambdas/closures.
 		bool weak_ref;
 	};
 
-	const IntrusivePtr<Val>& GetElementByID(const zeek::detail::ID* id) const;
+	const zeek::IntrusivePtr<Val>& GetElementByID(const zeek::detail::ID* id) const;
 
 	/**
 	 * Sets the element at index *n* of the underlying array to *v*, but does
@@ -322,7 +322,7 @@ private:
 	/** The next statement to be evaluted in the context of this frame. */
 	zeek::detail::Stmt* next_stmt;
 
-	IntrusivePtr<zeek::detail::trigger::Trigger> trigger;
+	zeek::IntrusivePtr<zeek::detail::trigger::Trigger> trigger;
 	const zeek::detail::CallExpr* call;
 
 	std::unique_ptr<std::vector<BroFunc*>> functions_with_closure_frame_reference;
diff --git a/src/Func.cc b/src/Func.cc
index 8bdcf2d2c5..c3a007b997 100644
--- a/src/Func.cc
+++ b/src/Func.cc
@@ -1,3 +1,4 @@
+
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
@@ -59,7 +60,7 @@ extern	RETSIGTYPE sig_handler(int signo);
 std::vector<CallInfo> call_stack;
 bool did_builtin_init = false;
 
-static const std::pair<bool, IntrusivePtr<Val>> empty_hook_result(false, nullptr);
+static const std::pair<bool, zeek::IntrusivePtr<Val>> empty_hook_result(false, nullptr);
 
 std::string render_call_stack()
 	{
@@ -110,34 +111,34 @@ std::string render_call_stack()
 Func::Func()
 	{
 	unique_id = unique_ids.size();
-	unique_ids.push_back({NewRef{}, this});
+	unique_ids.push_back({zeek::NewRef{}, this});
 	}
 
 Func::Func(Kind arg_kind) : kind(arg_kind)
 	{
 	unique_id = unique_ids.size();
-	unique_ids.push_back({NewRef{}, this});
+	unique_ids.push_back({zeek::NewRef{}, this});
 	}
 
 Func::~Func() = default;
 
-void Func::AddBody(IntrusivePtr<zeek::detail::Stmt> /* new_body */,
-                   const std::vector<IntrusivePtr<zeek::detail::ID>>& /* new_inits */,
+void Func::AddBody(zeek::IntrusivePtr<zeek::detail::Stmt> /* new_body */,
+                   const std::vector<zeek::IntrusivePtr<zeek::detail::ID>>& /* new_inits */,
                    size_t /* new_frame_size */, int /* priority */)
 	{
 	Internal("Func::AddBody called");
 	}
 
-void Func::SetScope(IntrusivePtr<Scope> newscope)
+void Func::SetScope(zeek::IntrusivePtr<Scope> newscope)
 	{
 	scope = std::move(newscope);
 	}
 
-IntrusivePtr<Func> Func::DoClone()
+zeek::IntrusivePtr<Func> Func::DoClone()
 	{
 	// By default, ok just to return a reference. Func does not have any state
 	// that is different across instances.
-	return {NewRef{}, this};
+	return {zeek::NewRef{}, this};
 	}
 
 void Func::DescribeDebug(ODesc* d, const zeek::Args* args) const
@@ -215,7 +216,7 @@ void Func::CopyStateInto(Func* other) const
 	other->unique_id = unique_id;
 	}
 
-void Func::CheckPluginResult(bool handled, const IntrusivePtr<Val>& hook_result,
+void Func::CheckPluginResult(bool handled, const zeek::IntrusivePtr<Val>& hook_result,
                              zeek::FunctionFlavor flavor) const
 	{
 	// Helper function factoring out this code from BroFunc:Call() for
@@ -268,8 +269,8 @@ void Func::CheckPluginResult(bool handled, const IntrusivePtr<Val>& hook_result,
 	}
 	}
 
-BroFunc::BroFunc(const IntrusivePtr<zeek::detail::ID>& arg_id, IntrusivePtr<zeek::detail::Stmt> arg_body,
-                 const std::vector<IntrusivePtr<zeek::detail::ID>>& aggr_inits,
+BroFunc::BroFunc(const zeek::IntrusivePtr<zeek::detail::ID>& arg_id, zeek::IntrusivePtr<zeek::detail::Stmt> arg_body,
+                 const std::vector<zeek::IntrusivePtr<zeek::detail::ID>>& aggr_inits,
                  size_t arg_frame_size, int priority)
 	: Func(BRO_FUNC)
 	{
@@ -304,7 +305,7 @@ Val* Func::Call(val_list* args, Frame* parent) const
 	return Invoke(&zargs, parent).release();
 	};
 
-IntrusivePtr<Val> BroFunc::Invoke(zeek::Args* args, Frame* parent) const
+zeek::IntrusivePtr<Val> BroFunc::Invoke(zeek::Args* args, Frame* parent) const
 	{
 #ifdef PROFILE_BRO_FUNCTIONS
 	DEBUG_MSG("Function: %s\n", Name());
@@ -330,7 +331,7 @@ IntrusivePtr<Val> BroFunc::Invoke(zeek::Args* args, Frame* parent) const
 		return Flavor() == zeek::FUNC_FLAVOR_HOOK ? val_mgr->True() : nullptr;
 		}
 
-	auto f = make_intrusive<Frame>(frame_size, this, args);
+	auto f = zeek::make_intrusive<Frame>(frame_size, this, args);
 
 	if ( closure )
 		f->CaptureClosure(closure, outer_ids);
@@ -338,7 +339,7 @@ IntrusivePtr<Val> BroFunc::Invoke(zeek::Args* args, Frame* parent) const
 	// Hand down any trigger.
 	if ( parent )
 		{
-		f->SetTrigger({NewRef{}, parent->GetTrigger()});
+		f->SetTrigger({zeek::NewRef{}, parent->GetTrigger()});
 		f->SetCall(parent->GetCall());
 		}
 
@@ -356,7 +357,7 @@ IntrusivePtr<Val> BroFunc::Invoke(zeek::Args* args, Frame* parent) const
 		}
 
 	stmt_flow_type flow = FLOW_NEXT;
-	IntrusivePtr<Val> result;
+	zeek::IntrusivePtr<Val> result;
 
 	for ( const auto& body : bodies )
 		{
@@ -449,8 +450,8 @@ IntrusivePtr<Val> BroFunc::Invoke(zeek::Args* args, Frame* parent) const
 	return result;
 	}
 
-void BroFunc::AddBody(IntrusivePtr<zeek::detail::Stmt> new_body,
-                      const std::vector<IntrusivePtr<zeek::detail::ID>>& new_inits,
+void BroFunc::AddBody(zeek::IntrusivePtr<zeek::detail::Stmt> new_body,
+                      const std::vector<zeek::IntrusivePtr<zeek::detail::ID>>& new_inits,
                       size_t new_frame_size, int priority)
 	{
 	if ( new_frame_size > frame_size )
@@ -540,11 +541,11 @@ bool BroFunc::UpdateClosure(const broker::vector& data)
 	}
 
 
-IntrusivePtr<Func> BroFunc::DoClone()
+zeek::IntrusivePtr<Func> BroFunc::DoClone()
 	{
 	// BroFunc could hold a closure. In this case a clone of it must
 	// store a copy of this closure.
-	auto other = IntrusivePtr{AdoptRef{}, new BroFunc()};
+	auto other = zeek::IntrusivePtr{zeek::AdoptRef{}, new BroFunc()};
 
 	CopyStateInto(other.get());
 
@@ -574,13 +575,14 @@ void BroFunc::Describe(ODesc* d) const
 		}
 	}
 
-IntrusivePtr<zeek::detail::Stmt> BroFunc::AddInits(IntrusivePtr<zeek::detail::Stmt> body,
-                                                   const std::vector<IntrusivePtr<zeek::detail::ID>>& inits)
+zeek::IntrusivePtr<zeek::detail::Stmt> BroFunc::AddInits(
+	zeek::IntrusivePtr<zeek::detail::Stmt> body,
+	const std::vector<zeek::IntrusivePtr<zeek::detail::ID>>& inits)
 	{
 	if ( inits.empty() )
 		return body;
 
-	auto stmt_series = make_intrusive<zeek::detail::StmtList>();
+	auto stmt_series = zeek::make_intrusive<zeek::detail::StmtList>();
 	stmt_series->Stmts().push_back(new zeek::detail::InitStmt(inits));
 	stmt_series->Stmts().push_back(body.release());
 
@@ -588,7 +590,7 @@ IntrusivePtr<zeek::detail::Stmt> BroFunc::AddInits(IntrusivePtr<zeek::detail::St
 	}
 
 BuiltinFunc::BuiltinFunc(built_in_func arg_func, const char* arg_name,
-			bool arg_is_pure)
+                         bool arg_is_pure)
 : Func(BUILTIN_FUNC)
 	{
 	func = arg_func;
@@ -602,7 +604,7 @@ BuiltinFunc::BuiltinFunc(built_in_func arg_func, const char* arg_name,
 		reporter->InternalError("built-in function %s multiply defined", Name());
 
 	type = id->GetType<zeek::FuncType>();
-	id->SetVal(make_intrusive<Val>(IntrusivePtr{NewRef{}, this}));
+	id->SetVal(zeek::make_intrusive<Val>(zeek::IntrusivePtr{zeek::NewRef{}, this}));
 	}
 
 BuiltinFunc::~BuiltinFunc()
@@ -614,7 +616,7 @@ bool BuiltinFunc::IsPure() const
 	return is_pure;
 	}
 
-IntrusivePtr<Val> BuiltinFunc::Invoke(zeek::Args* args, Frame* parent) const
+zeek::IntrusivePtr<Val> BuiltinFunc::Invoke(zeek::Args* args, Frame* parent) const
 	{
 #ifdef PROFILE_BRO_FUNCTIONS
 	DEBUG_MSG("Function: %s\n", Name());
@@ -665,10 +667,10 @@ void BuiltinFunc::Describe(ODesc* d) const
 
 void builtin_error(const char* msg)
 	{
-	builtin_error(msg, IntrusivePtr<Val>{});
+	builtin_error(msg, zeek::IntrusivePtr<Val>{});
 	}
 
-void builtin_error(const char* msg, IntrusivePtr<Val> arg)
+void builtin_error(const char* msg, zeek::IntrusivePtr<Val> arg)
 	{
 	builtin_error(msg, arg.get());
 	}
@@ -844,7 +846,7 @@ bool check_built_in_call(BuiltinFunc* f, zeek::detail::CallExpr* call)
 
 // Gets a function's priority from its Scope's attributes. Errors if it sees any
 // problems.
-static int get_func_priority(const std::vector<IntrusivePtr<zeek::detail::Attr>>& attrs)
+static int get_func_priority(const std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>& attrs)
 	{
 	int priority = 0;
 
@@ -879,7 +881,7 @@ static int get_func_priority(const std::vector<IntrusivePtr<zeek::detail::Attr>>
 	return priority;
 	}
 
-function_ingredients::function_ingredients(IntrusivePtr<Scope> scope, IntrusivePtr<zeek::detail::Stmt> body)
+function_ingredients::function_ingredients(zeek::IntrusivePtr<Scope> scope, zeek::IntrusivePtr<zeek::detail::Stmt> body)
 	{
 	frame_size = scope->Length();
 	inits = scope->GetInits();
diff --git a/src/Func.h b/src/Func.h
index b1a2eae796..03efa7c9f8 100644
--- a/src/Func.h
+++ b/src/Func.h
@@ -38,7 +38,7 @@ using caf::expected;
 
 class Func : public BroObj {
 public:
-	static inline const IntrusivePtr<Func> nil;
+	static inline const zeek::IntrusivePtr<Func> nil;
 
 	enum Kind { BRO_FUNC, BUILTIN_FUNC };
 
@@ -50,7 +50,7 @@ public:
 	zeek::FunctionFlavor Flavor() const	{ return GetType()->Flavor(); }
 
 	struct Body {
-		IntrusivePtr<zeek::detail::Stmt> stmts;
+		zeek::IntrusivePtr<zeek::detail::Stmt> stmts;
 		int priority;
 		bool operator<(const Body& other) const
 			{ return priority > other.priority; } // reverse sort
@@ -68,8 +68,8 @@ public:
 	 * @param parent  the frame from which the function is being called.
 	 * @return  the return value of the function call.
 	 */
-	virtual IntrusivePtr<Val> Invoke(zeek::Args* args,
-	                                   Frame* parent = nullptr) const = 0;
+	virtual zeek::IntrusivePtr<Val> Invoke(
+		zeek::Args* args, Frame* parent = nullptr) const = 0;
 
 	/**
 	 * A version of Invoke() taking a variable number of individual arguments.
@@ -77,8 +77,8 @@ public:
 	template <class... Args>
 	std::enable_if_t<
 	  std::is_convertible_v<std::tuple_element_t<0, std::tuple<Args...>>,
-	                        IntrusivePtr<Val>>,
-	  IntrusivePtr<Val>>
+	                        zeek::IntrusivePtr<Val>>,
+		zeek::IntrusivePtr<Val>>
 	Invoke(Args&&... args) const
 		{
 		auto zargs = zeek::Args{std::forward<Args>(args)...};
@@ -86,17 +86,17 @@ public:
 		}
 
 	// Add a new event handler to an existing function (event).
-	virtual void AddBody(IntrusivePtr<zeek::detail::Stmt> new_body,
-	                     const std::vector<IntrusivePtr<zeek::detail::ID>>& new_inits,
+	virtual void AddBody(zeek::IntrusivePtr<zeek::detail::Stmt> new_body,
+	                     const std::vector<zeek::IntrusivePtr<zeek::detail::ID>>& new_inits,
 	                     size_t new_frame_size, int priority = 0);
 
-	virtual void SetScope(IntrusivePtr<Scope> newscope);
+	virtual void SetScope(zeek::IntrusivePtr<Scope> newscope);
 	virtual Scope* GetScope() const		{ return scope.get(); }
 
 	[[deprecated("Remove in v4.1.  Use GetType().")]]
 	virtual zeek::FuncType* FType() const { return type.get(); }
 
-	const IntrusivePtr<zeek::FuncType>& GetType() const
+	const zeek::IntrusivePtr<zeek::FuncType>& GetType() const
 		{ return type; }
 
 	Kind GetKind() const	{ return kind; }
@@ -107,12 +107,12 @@ public:
 	void Describe(ODesc* d) const override = 0;
 	virtual void DescribeDebug(ODesc* d, const zeek::Args* args) const;
 
-	virtual IntrusivePtr<Func> DoClone();
+	virtual zeek::IntrusivePtr<Func> DoClone();
 
 	virtual TraversalCode Traverse(TraversalCallback* cb) const;
 
 	uint32_t GetUniqueFuncID() const { return unique_id; }
-	static const IntrusivePtr<Func>& GetFuncPtrByID(uint32_t id)
+	static const zeek::IntrusivePtr<Func>& GetFuncPtrByID(uint32_t id)
 		{ return id >= unique_ids.size() ? Func::nil : unique_ids[id]; }
 
 protected:
@@ -122,29 +122,29 @@ protected:
 	void CopyStateInto(Func* other) const;
 
 	// Helper function for checking result of plugin hook.
-	void CheckPluginResult(bool handled, const IntrusivePtr<Val>& hook_result,
+	void CheckPluginResult(bool handled, const zeek::IntrusivePtr<Val>& hook_result,
 	                       zeek::FunctionFlavor flavor) const;
 
 	std::vector<Body> bodies;
-	IntrusivePtr<Scope> scope;
+	zeek::IntrusivePtr<Scope> scope;
 	Kind kind;
 	uint32_t unique_id;
-	IntrusivePtr<zeek::FuncType> type;
+	zeek::IntrusivePtr<zeek::FuncType> type;
 	std::string name;
-	static inline std::vector<IntrusivePtr<Func>> unique_ids;
+	static inline std::vector<zeek::IntrusivePtr<Func>> unique_ids;
 };
 
 
 class BroFunc final : public Func {
 public:
-	BroFunc(const IntrusivePtr<zeek::detail::ID>& id, IntrusivePtr<zeek::detail::Stmt> body,
-	        const std::vector<IntrusivePtr<zeek::detail::ID>>& inits,
+	BroFunc(const zeek::IntrusivePtr<zeek::detail::ID>& id, zeek::IntrusivePtr<zeek::detail::Stmt> body,
+	        const std::vector<zeek::IntrusivePtr<zeek::detail::ID>>& inits,
 	        size_t frame_size, int priority);
 
 	~BroFunc() override;
 
 	bool IsPure() const override;
-	IntrusivePtr<Val> Invoke(zeek::Args* args, Frame* parent) const override;
+	zeek::IntrusivePtr<Val> Invoke(zeek::Args* args, Frame* parent) const override;
 
 	/**
 	 * Adds adds a closure to the function. Closures are cloned and
@@ -175,8 +175,8 @@ public:
 	 */
 	broker::expected<broker::data> SerializeClosure() const;
 
-	void AddBody(IntrusivePtr<zeek::detail::Stmt> new_body,
-	             const std::vector<IntrusivePtr<zeek::detail::ID>>& new_inits,
+	void AddBody(zeek::IntrusivePtr<zeek::detail::Stmt> new_body,
+	             const std::vector<zeek::IntrusivePtr<zeek::detail::ID>>& new_inits,
 	             size_t new_frame_size, int priority) override;
 
 	/** Sets this function's outer_id list. */
@@ -187,14 +187,14 @@ public:
 
 protected:
 	BroFunc() : Func(BRO_FUNC)	{}
-	IntrusivePtr<zeek::detail::Stmt> AddInits(
-		IntrusivePtr<zeek::detail::Stmt> body,
-		const std::vector<IntrusivePtr<zeek::detail::ID>>& inits);
+	zeek::IntrusivePtr<zeek::detail::Stmt> AddInits(
+		zeek::IntrusivePtr<zeek::detail::Stmt> body,
+		const std::vector<zeek::IntrusivePtr<zeek::detail::ID>>& inits);
 
 	/**
 	 * Clones this function along with its closures.
 	 */
-	IntrusivePtr<Func> DoClone() override;
+	zeek::IntrusivePtr<Func> DoClone() override;
 
 	/**
 	 * Performs a selective clone of *f* using the IDs that were
@@ -222,7 +222,7 @@ public:
 	~BuiltinFunc() override;
 
 	bool IsPure() const override;
-	IntrusivePtr<Val> Invoke(zeek::Args* args, Frame* parent) const override;
+	zeek::IntrusivePtr<Val> Invoke(zeek::Args* args, Frame* parent) const override;
 	built_in_func TheFunc() const	{ return func; }
 
 	void Describe(ODesc* d) const override;
@@ -236,7 +236,7 @@ protected:
 
 
 extern void builtin_error(const char* msg);
-extern void builtin_error(const char* msg, IntrusivePtr<Val>);
+extern void builtin_error(const char* msg, zeek::IntrusivePtr<Val>);
 extern void builtin_error(const char* msg, BroObj* arg);
 extern void init_builtin_funcs();
 extern void init_builtin_funcs_subdirs();
@@ -255,14 +255,14 @@ struct function_ingredients {
 
 	// Gathers all of the information from a scope and a function body needed
 	// to build a function.
-	function_ingredients(IntrusivePtr<Scope> scope, IntrusivePtr<zeek::detail::Stmt> body);
+	function_ingredients(zeek::IntrusivePtr<Scope> scope, zeek::IntrusivePtr<zeek::detail::Stmt> body);
 
-	IntrusivePtr<zeek::detail::ID> id;
-	IntrusivePtr<zeek::detail::Stmt> body;
-	std::vector<IntrusivePtr<zeek::detail::ID>> inits;
+	zeek::IntrusivePtr<zeek::detail::ID> id;
+	zeek::IntrusivePtr<zeek::detail::Stmt> body;
+	std::vector<zeek::IntrusivePtr<zeek::detail::ID>> inits;
 	int frame_size;
 	int priority;
-	IntrusivePtr<Scope> scope;
+	zeek::IntrusivePtr<Scope> scope;
 };
 
 extern std::vector<CallInfo> call_stack;
diff --git a/src/ID.cc b/src/ID.cc
index 641b9a2ac7..4f2558fd80 100644
--- a/src/ID.cc
+++ b/src/ID.cc
@@ -19,24 +19,24 @@
 #include "zeekygen/ScriptInfo.h"
 #include "module_util.h"
 
-IntrusivePtr<zeek::RecordType> zeek::id::conn_id;
-IntrusivePtr<zeek::RecordType> zeek::id::endpoint;
-IntrusivePtr<zeek::RecordType> zeek::id::connection;
-IntrusivePtr<zeek::RecordType> zeek::id::fa_file;
-IntrusivePtr<zeek::RecordType> zeek::id::fa_metadata;
-IntrusivePtr<zeek::EnumType> zeek::id::transport_proto;
-IntrusivePtr<zeek::TableType> zeek::id::string_set;
-IntrusivePtr<zeek::TableType> zeek::id::string_array;
-IntrusivePtr<zeek::TableType> zeek::id::count_set;
-IntrusivePtr<zeek::VectorType> zeek::id::string_vec;
-IntrusivePtr<zeek::VectorType> zeek::id::index_vec;
+zeek::IntrusivePtr<zeek::RecordType> zeek::id::conn_id;
+zeek::IntrusivePtr<zeek::RecordType> zeek::id::endpoint;
+zeek::IntrusivePtr<zeek::RecordType> zeek::id::connection;
+zeek::IntrusivePtr<zeek::RecordType> zeek::id::fa_file;
+zeek::IntrusivePtr<zeek::RecordType> zeek::id::fa_metadata;
+zeek::IntrusivePtr<zeek::EnumType> zeek::id::transport_proto;
+zeek::IntrusivePtr<zeek::TableType> zeek::id::string_set;
+zeek::IntrusivePtr<zeek::TableType> zeek::id::string_array;
+zeek::IntrusivePtr<zeek::TableType> zeek::id::count_set;
+zeek::IntrusivePtr<zeek::VectorType> zeek::id::string_vec;
+zeek::IntrusivePtr<zeek::VectorType> zeek::id::index_vec;
 
-const IntrusivePtr<zeek::detail::ID>& zeek::id::find(std::string_view name)
+const zeek::IntrusivePtr<zeek::detail::ID>& zeek::id::find(std::string_view name)
 	{
 	return global_scope()->Find(name);
 	}
 
-const IntrusivePtr<zeek::Type>& zeek::id::find_type(std::string_view name)
+const zeek::IntrusivePtr<zeek::Type>& zeek::id::find_type(std::string_view name)
 	{
 	auto id = global_scope()->Find(name);
 
@@ -47,7 +47,7 @@ const IntrusivePtr<zeek::Type>& zeek::id::find_type(std::string_view name)
 	return id->GetType();
 	}
 
-const IntrusivePtr<Val>& zeek::id::find_val(std::string_view name)
+const zeek::IntrusivePtr<Val>& zeek::id::find_val(std::string_view name)
 	{
 	auto id = global_scope()->Find(name);
 
@@ -58,7 +58,7 @@ const IntrusivePtr<Val>& zeek::id::find_val(std::string_view name)
 	return id->GetVal();
 	}
 
-const IntrusivePtr<Val>& zeek::id::find_const(std::string_view name)
+const zeek::IntrusivePtr<Val>& zeek::id::find_const(std::string_view name)
 	{
 	auto id = global_scope()->Find(name);
 
@@ -73,7 +73,7 @@ const IntrusivePtr<Val>& zeek::id::find_const(std::string_view name)
 	return id->GetVal();
 	}
 
-IntrusivePtr<Func> zeek::id::find_func(std::string_view name)
+zeek::IntrusivePtr<Func> zeek::id::find_func(std::string_view name)
 	{
 	const auto& v = zeek::id::find_val(name);
 
@@ -130,7 +130,7 @@ std::string ID::ModuleName() const
 	return extract_module_name(name);
 	}
 
-void ID::SetType(IntrusivePtr<zeek::Type> t)
+void ID::SetType(zeek::IntrusivePtr<zeek::Type> t)
 	{
 	type = std::move(t);
 	}
@@ -140,7 +140,7 @@ void ID::ClearVal()
 	val = nullptr;
 	}
 
-void ID::SetVal(IntrusivePtr<Val> v)
+void ID::SetVal(zeek::IntrusivePtr<Val> v)
 	{
 	val = std::move(v);
 	Modified();
@@ -169,7 +169,7 @@ void ID::SetVal(IntrusivePtr<Val> v)
 		}
 	}
 
-void ID::SetVal(IntrusivePtr<Val> v, InitClass c)
+void ID::SetVal(zeek::IntrusivePtr<Val> v, InitClass c)
 	{
 	if ( c == INIT_NONE || c == INIT_FULL )
 		{
@@ -207,7 +207,7 @@ void ID::SetVal(IntrusivePtr<Val> v, InitClass c)
 		}
 	}
 
-void ID::SetVal(IntrusivePtr<Expr> ev, InitClass c)
+void ID::SetVal(zeek::IntrusivePtr<Expr> ev, InitClass c)
 	{
 	const auto& a = attrs->Find(c == INIT_EXTRA ? ATTR_ADD_FUNC : ATTR_DEL_FUNC);
 
@@ -222,7 +222,7 @@ bool ID::IsRedefinable() const
 	return GetAttr(ATTR_REDEF) != nullptr;
 	}
 
-void ID::SetAttrs(IntrusivePtr<Attributes> a)
+void ID::SetAttrs(zeek::IntrusivePtr<Attributes> a)
 	{
 	attrs = nullptr;
 	AddAttrs(std::move(a));
@@ -260,15 +260,15 @@ void ID::UpdateValAttrs()
 				TypeDecl* fd = rt->FieldDecl(i);
 
 				if ( ! fd->attrs )
-					fd->attrs = make_intrusive<Attributes>(rt->GetFieldType(i), true, IsGlobal());
+					fd->attrs = zeek::make_intrusive<Attributes>(rt->GetFieldType(i), true, IsGlobal());
 
-				fd->attrs->AddAttr(make_intrusive<Attr>(ATTR_LOG));
+				fd->attrs->AddAttr(zeek::make_intrusive<Attr>(ATTR_LOG));
 				}
 			}
 		}
 	}
 
-const IntrusivePtr<Attr>& ID::GetAttr(AttrTag t) const
+const zeek::IntrusivePtr<Attr>& ID::GetAttr(AttrTag t) const
 	{
 	return attrs ? attrs->Find(t) : Attr::nil;
 	}
@@ -278,13 +278,13 @@ bool ID::IsDeprecated() const
 	return GetAttr(ATTR_DEPRECATED) != nullptr;
 	}
 
-void ID::MakeDeprecated(IntrusivePtr<Expr> deprecation)
+void ID::MakeDeprecated(zeek::IntrusivePtr<Expr> deprecation)
 	{
 	if ( IsDeprecated() )
 		return;
 
-	std::vector<IntrusivePtr<Attr>> attrv{make_intrusive<Attr>(ATTR_DEPRECATED, std::move(deprecation))};
-	AddAttrs(make_intrusive<Attributes>(std::move(attrv), GetType(), false, IsGlobal()));
+	std::vector<zeek::IntrusivePtr<Attr>> attrv{zeek::make_intrusive<Attr>(ATTR_DEPRECATED, std::move(deprecation))};
+	AddAttrs(zeek::make_intrusive<Attributes>(std::move(attrv), GetType(), false, IsGlobal()));
 	}
 
 std::string ID::GetDeprecationWarning() const
@@ -308,7 +308,7 @@ std::string ID::GetDeprecationWarning() const
 		return fmt("deprecated (%s): %s", Name(), result.c_str());
 	}
 
-void ID::AddAttrs(IntrusivePtr<Attributes> a)
+void ID::AddAttrs(zeek::IntrusivePtr<Attributes> a)
 	{
 	if ( attrs )
 		attrs->AddAttrs(a);
@@ -334,18 +334,18 @@ void ID::SetOption()
 	// option implied redefinable
 	if ( ! IsRedefinable() )
 		{
-		std::vector<IntrusivePtr<Attr>> attrv{make_intrusive<Attr>(ATTR_REDEF)};
-		AddAttrs(make_intrusive<Attributes>(std::move(attrv), GetType(), false, IsGlobal()));
+		std::vector<zeek::IntrusivePtr<Attr>> attrv{zeek::make_intrusive<Attr>(ATTR_REDEF)};
+		AddAttrs(zeek::make_intrusive<Attributes>(std::move(attrv), GetType(), false, IsGlobal()));
 		}
 	}
 
-void ID::EvalFunc(IntrusivePtr<Expr> ef, IntrusivePtr<Expr> ev)
+void ID::EvalFunc(zeek::IntrusivePtr<Expr> ef, zeek::IntrusivePtr<Expr> ev)
 	{
-	auto arg1 = make_intrusive<zeek::detail::ConstExpr>(val);
-	auto args = make_intrusive<zeek::detail::ListExpr>();
+	auto arg1 = zeek::make_intrusive<zeek::detail::ConstExpr>(val);
+	auto args = zeek::make_intrusive<zeek::detail::ListExpr>();
 	args->Append(std::move(arg1));
 	args->Append(std::move(ev));
-	auto ce = make_intrusive<CallExpr>(std::move(ef), std::move(args));
+	auto ce = zeek::make_intrusive<CallExpr>(std::move(ef), std::move(args));
 	SetVal(ce->Eval(nullptr));
 	}
 
@@ -642,7 +642,7 @@ void ID::UpdateValID()
 	}
 #endif
 
-void ID::AddOptionHandler(IntrusivePtr<Func> callback, int priority)
+void ID::AddOptionHandler(zeek::IntrusivePtr<Func> callback, int priority)
 	{
 	option_handlers.emplace(priority, std::move(callback));
 	}
diff --git a/src/ID.h b/src/ID.h
index 275a71559a..4c0d4313fc 100644
--- a/src/ID.h
+++ b/src/ID.h
@@ -34,7 +34,7 @@ enum IDScope { SCOPE_FUNCTION, SCOPE_MODULE, SCOPE_GLOBAL };
 
 class ID final : public BroObj, public notifier::Modifiable {
 public:
-	static inline const IntrusivePtr<ID> nil;
+	static inline const zeek::IntrusivePtr<ID> nil;
 
 	ID(const char* name, IDScope arg_scope, bool arg_is_export);
 
@@ -50,19 +50,19 @@ public:
 
 	std::string ModuleName() const;
 
-	void SetType(IntrusivePtr<Type> t);
+	void SetType(zeek::IntrusivePtr<Type> t);
 
 	[[deprecated("Remove in v4.1.  Use GetType().")]]
 	zeek::Type* Type()			{ return type.get(); }
 	[[deprecated("Remove in v4.1.  Use GetType().")]]
 	const zeek::Type* Type() const	{ return type.get(); }
 
-	const IntrusivePtr<zeek::Type>& GetType() const
+	const zeek::IntrusivePtr<zeek::Type>& GetType() const
 		{ return type; }
 
 	template <class T>
-	IntrusivePtr<T> GetType() const
-		{ return cast_intrusive<T>(type); }
+	zeek::IntrusivePtr<T> GetType() const
+		{ return zeek::cast_intrusive<T>(type); }
 
 	[[deprecated("Remove in v4.1.  Use IsType() and GetType().")]]
 	zeek::Type* AsType()		{ return is_type ? GetType().get() : nullptr; }
@@ -74,10 +74,10 @@ public:
 
 	void MakeType()			{ is_type = true; }
 
-	void SetVal(IntrusivePtr<Val> v);
+	void SetVal(zeek::IntrusivePtr<Val> v);
 
-	void SetVal(IntrusivePtr<Val> v, InitClass c);
-	void SetVal(IntrusivePtr<Expr> ev, InitClass c);
+	void SetVal(zeek::IntrusivePtr<Val> v, InitClass c);
+	void SetVal(zeek::IntrusivePtr<Expr> ev, InitClass c);
 
 	bool HasVal() const		{ return val != nullptr; }
 
@@ -86,7 +86,7 @@ public:
 	[[deprecated("Remove in v4.1.  Use GetVal().")]]
 	const Val* ID_Val() const	{ return val.get(); }
 
-	const IntrusivePtr<Val>& GetVal() const
+	const zeek::IntrusivePtr<Val>& GetVal() const
 		{ return val; }
 
 	void ClearVal();
@@ -105,22 +105,22 @@ public:
 
 	bool IsRedefinable() const;
 
-	void SetAttrs(IntrusivePtr<Attributes> attr);
-	void AddAttrs(IntrusivePtr<Attributes> attr);
+	void SetAttrs(zeek::IntrusivePtr<Attributes> attr);
+	void AddAttrs(zeek::IntrusivePtr<Attributes> attr);
 	void RemoveAttr(zeek::detail::AttrTag a);
 	void UpdateValAttrs();
 
-	const IntrusivePtr<Attributes>& GetAttrs() const
+	const zeek::IntrusivePtr<Attributes>& GetAttrs() const
 		{ return attrs; }
 
 	[[deprecated("Remove in 4.1.  Use GetAttrs().")]]
 	Attributes* Attrs() const	{ return attrs.get(); }
 
-	const IntrusivePtr<zeek::detail::Attr>& GetAttr(zeek::detail::AttrTag t) const;
+	const zeek::IntrusivePtr<zeek::detail::Attr>& GetAttr(zeek::detail::AttrTag t) const;
 
 	bool IsDeprecated() const;
 
-	void MakeDeprecated(IntrusivePtr<Expr> deprecation);
+	void MakeDeprecated(zeek::IntrusivePtr<Expr> deprecation);
 
 	std::string GetDeprecationWarning() const;
 
@@ -143,11 +143,11 @@ public:
 	bool HasOptionHandlers() const
 		{ return !option_handlers.empty(); }
 
-	void AddOptionHandler(IntrusivePtr<Func> callback, int priority);
+	void AddOptionHandler(zeek::IntrusivePtr<Func> callback, int priority);
 	std::vector<Func*> GetOptionHandlers() const;
 
 protected:
-	void EvalFunc(IntrusivePtr<Expr> ef, IntrusivePtr<Expr> ev);
+	void EvalFunc(zeek::IntrusivePtr<Expr> ef, zeek::IntrusivePtr<Expr> ev);
 
 #ifdef DEBUG
 	void UpdateValID();
@@ -157,13 +157,13 @@ protected:
 	IDScope scope;
 	bool is_export;
 	bool infer_return_type;
-	IntrusivePtr<zeek::Type> type;
+	zeek::IntrusivePtr<zeek::Type> type;
 	bool is_const, is_enum_const, is_type, is_option;
 	int offset;
-	IntrusivePtr<Val> val;
-	IntrusivePtr<Attributes> attrs;
+	zeek::IntrusivePtr<Val> val;
+	zeek::IntrusivePtr<Attributes> attrs;
 	// contains list of functions that are called when an option changes
-	std::multimap<int, IntrusivePtr<Func>> option_handlers;
+	std::multimap<int, zeek::IntrusivePtr<Func>> option_handlers;
 
 };
 
@@ -179,7 +179,7 @@ namespace zeek::id {
  * @return  The identifier, which may reference a nil object if no such
  * name exists.
  */
-const IntrusivePtr<zeek::detail::ID>& find(std::string_view name);
+const zeek::IntrusivePtr<zeek::detail::ID>& find(std::string_view name);
 
 /**
  * Lookup an ID by its name and return its type.  A fatal occurs if the ID
@@ -187,7 +187,7 @@ const IntrusivePtr<zeek::detail::ID>& find(std::string_view name);
  * @param name  The identifier name to lookup
  * @return  The type of the identifier.
  */
-const IntrusivePtr<zeek::Type>& find_type(std::string_view name);
+const zeek::IntrusivePtr<zeek::Type>& find_type(std::string_view name);
 
 /**
  * Lookup an ID by its name and return its type (as cast to @c T).
@@ -196,8 +196,8 @@ const IntrusivePtr<zeek::Type>& find_type(std::string_view name);
  * @return  The type of the identifier.
  */
 template<class T>
-IntrusivePtr<T> find_type(std::string_view name)
-	{ return cast_intrusive<T>(find_type(name)); }
+zeek::IntrusivePtr<T> find_type(std::string_view name)
+	{ return zeek::cast_intrusive<T>(find_type(name)); }
 
 /**
  * Lookup an ID by its name and return its value.  A fatal occurs if the ID
@@ -205,7 +205,7 @@ IntrusivePtr<T> find_type(std::string_view name)
  * @param name  The identifier name to lookup
  * @return  The current value of the identifier
  */
-const IntrusivePtr<Val>& find_val(std::string_view name);
+const zeek::IntrusivePtr<Val>& find_val(std::string_view name);
 
 /**
  * Lookup an ID by its name and return its value (as cast to @c T).
@@ -214,8 +214,8 @@ const IntrusivePtr<Val>& find_val(std::string_view name);
  * @return  The current value of the identifier.
  */
 template<class T>
-IntrusivePtr<T> find_val(std::string_view name)
-	{ return cast_intrusive<T>(find_val(name)); }
+zeek::IntrusivePtr<T> find_val(std::string_view name)
+	{ return zeek::cast_intrusive<T>(find_val(name)); }
 
 /**
  * Lookup an ID by its name and return its value.  A fatal occurs if the ID
@@ -223,7 +223,7 @@ IntrusivePtr<T> find_val(std::string_view name)
  * @param name  The identifier name to lookup
  * @return  The current value of the identifier
  */
-const IntrusivePtr<Val>& find_const(std::string_view name);
+const zeek::IntrusivePtr<Val>& find_const(std::string_view name);
 
 /**
  * Lookup an ID by its name and return its value (as cast to @c T).
@@ -232,8 +232,8 @@ const IntrusivePtr<Val>& find_const(std::string_view name);
  * @return  The current value of the identifier.
  */
 template<class T>
-IntrusivePtr<T> find_const(std::string_view name)
-	{ return cast_intrusive<T>(find_const(name)); }
+zeek::IntrusivePtr<T> find_const(std::string_view name)
+	{ return zeek::cast_intrusive<T>(find_const(name)); }
 
 /**
  * Lookup an ID by its name and return the function it references.
@@ -241,19 +241,19 @@ IntrusivePtr<T> find_const(std::string_view name)
  * @param name  The identifier name to lookup
  * @return  The current function value the identifier references.
  */
-IntrusivePtr<Func> find_func(std::string_view name);
+zeek::IntrusivePtr<Func> find_func(std::string_view name);
 
-extern IntrusivePtr<zeek::RecordType> conn_id;
-extern IntrusivePtr<zeek::RecordType> endpoint;
-extern IntrusivePtr<zeek::RecordType> connection;
-extern IntrusivePtr<zeek::RecordType> fa_file;
-extern IntrusivePtr<zeek::RecordType> fa_metadata;
-extern IntrusivePtr<zeek::EnumType> transport_proto;
-extern IntrusivePtr<zeek::TableType> string_set;
-extern IntrusivePtr<zeek::TableType> string_array;
-extern IntrusivePtr<zeek::TableType> count_set;
-extern IntrusivePtr<zeek::VectorType> string_vec;
-extern IntrusivePtr<zeek::VectorType> index_vec;
+extern zeek::IntrusivePtr<zeek::RecordType> conn_id;
+extern zeek::IntrusivePtr<zeek::RecordType> endpoint;
+extern zeek::IntrusivePtr<zeek::RecordType> connection;
+extern zeek::IntrusivePtr<zeek::RecordType> fa_file;
+extern zeek::IntrusivePtr<zeek::RecordType> fa_metadata;
+extern zeek::IntrusivePtr<zeek::EnumType> transport_proto;
+extern zeek::IntrusivePtr<zeek::TableType> string_set;
+extern zeek::IntrusivePtr<zeek::TableType> string_array;
+extern zeek::IntrusivePtr<zeek::TableType> count_set;
+extern zeek::IntrusivePtr<zeek::VectorType> string_vec;
+extern zeek::IntrusivePtr<zeek::VectorType> index_vec;
 
 namespace detail {
 
diff --git a/src/IP.cc b/src/IP.cc
index 098ba3f468..b17f1f85ac 100644
--- a/src/IP.cc
+++ b/src/IP.cc
@@ -13,15 +13,15 @@
 #include "BroString.h"
 #include "Reporter.h"
 
-static IntrusivePtr<VectorVal> BuildOptionsVal(const u_char* data, int len)
+static zeek::IntrusivePtr<VectorVal> BuildOptionsVal(const u_char* data, int len)
 	{
-	auto vv = make_intrusive<VectorVal>(zeek::id::find_type<zeek::VectorType>("ip6_options"));
+	auto vv = zeek::make_intrusive<VectorVal>(zeek::id::find_type<zeek::VectorType>("ip6_options"));
 
 	while ( len > 0 )
 		{
 		static auto ip6_option_type = zeek::id::find_type<zeek::RecordType>("ip6_option");
 		const struct ip6_opt* opt = (const struct ip6_opt*) data;
-		auto rv = make_intrusive<RecordVal>(ip6_option_type);
+		auto rv = zeek::make_intrusive<RecordVal>(ip6_option_type);
 		rv->Assign(0, val_mgr->Count(opt->ip6o_type));
 
 		if ( opt->ip6o_type == 0 )
@@ -37,7 +37,7 @@ static IntrusivePtr<VectorVal> BuildOptionsVal(const u_char* data, int len)
 			// PadN or other option
 			uint16_t off = 2 * sizeof(uint8_t);
 			rv->Assign(1, val_mgr->Count(opt->ip6o_len));
-			rv->Assign(2, make_intrusive<StringVal>(
+			rv->Assign(2, zeek::make_intrusive<StringVal>(
 			        new BroString(data + off, opt->ip6o_len, true)));
 			data += opt->ip6o_len + off;
 			len -= opt->ip6o_len + off;
@@ -49,25 +49,25 @@ static IntrusivePtr<VectorVal> BuildOptionsVal(const u_char* data, int len)
 	return vv;
 	}
 
-IntrusivePtr<RecordVal> IPv6_Hdr::ToVal(IntrusivePtr<VectorVal> chain) const
+zeek::IntrusivePtr<RecordVal> IPv6_Hdr::ToVal(zeek::IntrusivePtr<VectorVal> chain) const
 	{
-	IntrusivePtr<RecordVal> rv;
+	zeek::IntrusivePtr<RecordVal> rv;
 
 	switch ( type ) {
 	case IPPROTO_IPV6:
 		{
 		static auto ip6_hdr_type = zeek::id::find_type<zeek::RecordType>("ip6_hdr");
-		rv = make_intrusive<RecordVal>(ip6_hdr_type);
+		rv = zeek::make_intrusive<RecordVal>(ip6_hdr_type);
 		const struct ip6_hdr* ip6 = (const struct ip6_hdr*)data;
 		rv->Assign(0, val_mgr->Count((ntohl(ip6->ip6_flow) & 0x0ff00000)>>20));
 		rv->Assign(1, val_mgr->Count(ntohl(ip6->ip6_flow) & 0x000fffff));
 		rv->Assign(2, val_mgr->Count(ntohs(ip6->ip6_plen)));
 		rv->Assign(3, val_mgr->Count(ip6->ip6_nxt));
 		rv->Assign(4, val_mgr->Count(ip6->ip6_hlim));
-		rv->Assign(5, make_intrusive<AddrVal>(IPAddr(ip6->ip6_src)));
-		rv->Assign(6, make_intrusive<AddrVal>(IPAddr(ip6->ip6_dst)));
+		rv->Assign(5, zeek::make_intrusive<AddrVal>(IPAddr(ip6->ip6_src)));
+		rv->Assign(6, zeek::make_intrusive<AddrVal>(IPAddr(ip6->ip6_dst)));
 		if ( ! chain )
-			chain = make_intrusive<VectorVal>(
+			chain = zeek::make_intrusive<VectorVal>(
 			    zeek::id::find_type<zeek::VectorType>("ip6_ext_hdr_chain"));
 		rv->Assign(7, std::move(chain));
 		}
@@ -76,7 +76,7 @@ IntrusivePtr<RecordVal> IPv6_Hdr::ToVal(IntrusivePtr<VectorVal> chain) const
 	case IPPROTO_HOPOPTS:
 		{
 		static auto ip6_hopopts_type = zeek::id::find_type<zeek::RecordType>("ip6_hopopts");
-		rv = make_intrusive<RecordVal>(ip6_hopopts_type);
+		rv = zeek::make_intrusive<RecordVal>(ip6_hopopts_type);
 		const struct ip6_hbh* hbh = (const struct ip6_hbh*)data;
 		rv->Assign(0, val_mgr->Count(hbh->ip6h_nxt));
 		rv->Assign(1, val_mgr->Count(hbh->ip6h_len));
@@ -89,7 +89,7 @@ IntrusivePtr<RecordVal> IPv6_Hdr::ToVal(IntrusivePtr<VectorVal> chain) const
 	case IPPROTO_DSTOPTS:
 		{
 		static auto ip6_dstopts_type = zeek::id::find_type<zeek::RecordType>("ip6_dstopts");
-		rv = make_intrusive<RecordVal>(ip6_dstopts_type);
+		rv = zeek::make_intrusive<RecordVal>(ip6_dstopts_type);
 		const struct ip6_dest* dst = (const struct ip6_dest*)data;
 		rv->Assign(0, val_mgr->Count(dst->ip6d_nxt));
 		rv->Assign(1, val_mgr->Count(dst->ip6d_len));
@@ -101,21 +101,21 @@ IntrusivePtr<RecordVal> IPv6_Hdr::ToVal(IntrusivePtr<VectorVal> chain) const
 	case IPPROTO_ROUTING:
 		{
 		static auto ip6_routing_type = zeek::id::find_type<zeek::RecordType>("ip6_routing");
-		rv = make_intrusive<RecordVal>(ip6_routing_type);
+		rv = zeek::make_intrusive<RecordVal>(ip6_routing_type);
 		const struct ip6_rthdr* rt = (const struct ip6_rthdr*)data;
 		rv->Assign(0, val_mgr->Count(rt->ip6r_nxt));
 		rv->Assign(1, val_mgr->Count(rt->ip6r_len));
 		rv->Assign(2, val_mgr->Count(rt->ip6r_type));
 		rv->Assign(3, val_mgr->Count(rt->ip6r_segleft));
 		uint16_t off = 4 * sizeof(uint8_t);
-		rv->Assign(4, make_intrusive<StringVal>(new BroString(data + off, Length() - off, true)));
+		rv->Assign(4, zeek::make_intrusive<StringVal>(new BroString(data + off, Length() - off, true)));
 		}
 		break;
 
 	case IPPROTO_FRAGMENT:
 		{
 		static auto ip6_fragment_type = zeek::id::find_type<zeek::RecordType>("ip6_fragment");
-		rv = make_intrusive<RecordVal>(ip6_fragment_type);
+		rv = zeek::make_intrusive<RecordVal>(ip6_fragment_type);
 		const struct ip6_frag* frag = (const struct ip6_frag*)data;
 		rv->Assign(0, val_mgr->Count(frag->ip6f_nxt));
 		rv->Assign(1, val_mgr->Count(frag->ip6f_reserved));
@@ -129,7 +129,7 @@ IntrusivePtr<RecordVal> IPv6_Hdr::ToVal(IntrusivePtr<VectorVal> chain) const
 	case IPPROTO_AH:
 		{
 		static auto ip6_ah_type = zeek::id::find_type<zeek::RecordType>("ip6_ah");
-		rv = make_intrusive<RecordVal>(ip6_ah_type);
+		rv = zeek::make_intrusive<RecordVal>(ip6_ah_type);
 		rv->Assign(0, val_mgr->Count(((ip6_ext*)data)->ip6e_nxt));
 		rv->Assign(1, val_mgr->Count(((ip6_ext*)data)->ip6e_len));
 		rv->Assign(2, val_mgr->Count(ntohs(((uint16_t*)data)[1])));
@@ -141,7 +141,7 @@ IntrusivePtr<RecordVal> IPv6_Hdr::ToVal(IntrusivePtr<VectorVal> chain) const
 			// Payload Len was non-zero for this header.
 			rv->Assign(4, val_mgr->Count(ntohl(((uint32_t*)data)[2])));
 			uint16_t off = 3 * sizeof(uint32_t);
-			rv->Assign(5, make_intrusive<StringVal>(new BroString(data + off, Length() - off, true)));
+			rv->Assign(5, zeek::make_intrusive<StringVal>(new BroString(data + off, Length() - off, true)));
 			}
 		}
 		break;
@@ -149,7 +149,7 @@ IntrusivePtr<RecordVal> IPv6_Hdr::ToVal(IntrusivePtr<VectorVal> chain) const
 	case IPPROTO_ESP:
 		{
 		static auto ip6_esp_type = zeek::id::find_type<zeek::RecordType>("ip6_esp");
-		rv = make_intrusive<RecordVal>(ip6_esp_type);
+		rv = zeek::make_intrusive<RecordVal>(ip6_esp_type);
 		const uint32_t* esp = (const uint32_t*)data;
 		rv->Assign(0, val_mgr->Count(ntohl(esp[0])));
 		rv->Assign(1, val_mgr->Count(ntohl(esp[1])));
@@ -160,7 +160,7 @@ IntrusivePtr<RecordVal> IPv6_Hdr::ToVal(IntrusivePtr<VectorVal> chain) const
 	case IPPROTO_MOBILITY:
 		{
 		static auto ip6_mob_type = zeek::id::find_type<zeek::RecordType>("ip6_mobility_hdr");
-		rv = make_intrusive<RecordVal>(ip6_mob_type);
+		rv = zeek::make_intrusive<RecordVal>(ip6_mob_type);
 		const struct ip6_mobility* mob = (const struct ip6_mobility*) data;
 		rv->Assign(0, val_mgr->Count(mob->ip6mob_payload));
 		rv->Assign(1, val_mgr->Count(mob->ip6mob_len));
@@ -169,7 +169,7 @@ IntrusivePtr<RecordVal> IPv6_Hdr::ToVal(IntrusivePtr<VectorVal> chain) const
 		rv->Assign(4, val_mgr->Count(ntohs(mob->ip6mob_chksum)));
 
 		static auto ip6_mob_msg_type = zeek::id::find_type<zeek::RecordType>("ip6_mobility_msg");
-		auto msg = make_intrusive<RecordVal>(ip6_mob_msg_type);
+		auto msg = zeek::make_intrusive<RecordVal>(ip6_mob_msg_type);
 		msg->Assign(0, val_mgr->Count(mob->ip6mob_type));
 
 		uint16_t off = sizeof(ip6_mobility);
@@ -187,7 +187,7 @@ IntrusivePtr<RecordVal> IPv6_Hdr::ToVal(IntrusivePtr<VectorVal> chain) const
 		switch ( mob->ip6mob_type ) {
 		case 0:
 			{
-			auto m = make_intrusive<RecordVal>(ip6_mob_brr_type);
+			auto m = zeek::make_intrusive<RecordVal>(ip6_mob_brr_type);
 			m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data))));
 			off += sizeof(uint16_t);
 			m->Assign(1, BuildOptionsVal(data + off, Length() - off));
@@ -197,7 +197,7 @@ IntrusivePtr<RecordVal> IPv6_Hdr::ToVal(IntrusivePtr<VectorVal> chain) const
 
 		case 1:
 			{
-			auto m = make_intrusive<RecordVal>(ip6_mobility_hoti_type);
+			auto m = zeek::make_intrusive<RecordVal>(ip6_mobility_hoti_type);
 			m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data))));
 			m->Assign(1, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t))))));
 			off += sizeof(uint16_t) + sizeof(uint64_t);
@@ -208,7 +208,7 @@ IntrusivePtr<RecordVal> IPv6_Hdr::ToVal(IntrusivePtr<VectorVal> chain) const
 
 		case 2:
 			{
-			auto m = make_intrusive<RecordVal>(ip6_mobility_coti_type);
+			auto m = zeek::make_intrusive<RecordVal>(ip6_mobility_coti_type);
 			m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data))));
 			m->Assign(1, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t))))));
 			off += sizeof(uint16_t) + sizeof(uint64_t);
@@ -219,7 +219,7 @@ IntrusivePtr<RecordVal> IPv6_Hdr::ToVal(IntrusivePtr<VectorVal> chain) const
 
 		case 3:
 			{
-			auto m = make_intrusive<RecordVal>(ip6_mobility_hot_type);
+			auto m = zeek::make_intrusive<RecordVal>(ip6_mobility_hot_type);
 			m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data))));
 			m->Assign(1, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t))))));
 			m->Assign(2, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t) + sizeof(uint64_t))))));
@@ -231,7 +231,7 @@ IntrusivePtr<RecordVal> IPv6_Hdr::ToVal(IntrusivePtr<VectorVal> chain) const
 
 		case 4:
 			{
-			auto m = make_intrusive<RecordVal>(ip6_mobility_cot_type);
+			auto m = zeek::make_intrusive<RecordVal>(ip6_mobility_cot_type);
 			m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data))));
 			m->Assign(1, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t))))));
 			m->Assign(2, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t) + sizeof(uint64_t))))));
@@ -243,7 +243,7 @@ IntrusivePtr<RecordVal> IPv6_Hdr::ToVal(IntrusivePtr<VectorVal> chain) const
 
 		case 5:
 			{
-			auto m = make_intrusive<RecordVal>(ip6_mobility_bu_type);
+			auto m = zeek::make_intrusive<RecordVal>(ip6_mobility_bu_type);
 			m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data))));
 			m->Assign(1, val_mgr->Bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x8000));
 			m->Assign(2, val_mgr->Bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x4000));
@@ -258,7 +258,7 @@ IntrusivePtr<RecordVal> IPv6_Hdr::ToVal(IntrusivePtr<VectorVal> chain) const
 
 		case 6:
 			{
-			auto m = make_intrusive<RecordVal>(ip6_mobility_back_type);
+			auto m = zeek::make_intrusive<RecordVal>(ip6_mobility_back_type);
 			m->Assign(0, val_mgr->Count(*((uint8_t*)msg_data)));
 			m->Assign(1, val_mgr->Bool(*((uint8_t*)(msg_data + sizeof(uint8_t))) & 0x80));
 			m->Assign(2, val_mgr->Count(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t))))));
@@ -271,10 +271,10 @@ IntrusivePtr<RecordVal> IPv6_Hdr::ToVal(IntrusivePtr<VectorVal> chain) const
 
 		case 7:
 			{
-			auto m = make_intrusive<RecordVal>(ip6_mobility_be_type);
+			auto m = zeek::make_intrusive<RecordVal>(ip6_mobility_be_type);
 			m->Assign(0, val_mgr->Count(*((uint8_t*)msg_data)));
 			const in6_addr* hoa = (const in6_addr*)(msg_data + sizeof(uint16_t));
-			m->Assign(1, make_intrusive<AddrVal>(IPAddr(*hoa)));
+			m->Assign(1, zeek::make_intrusive<AddrVal>(IPAddr(*hoa)));
 			off += sizeof(uint16_t) + sizeof(in6_addr);
 			m->Assign(2, BuildOptionsVal(data + off, Length() - off));
 			msg->Assign(8, std::move(m));
@@ -298,12 +298,12 @@ IntrusivePtr<RecordVal> IPv6_Hdr::ToVal(IntrusivePtr<VectorVal> chain) const
 	return rv;
 	}
 
-IntrusivePtr<RecordVal> IPv6_Hdr::ToVal() const
+zeek::IntrusivePtr<RecordVal> IPv6_Hdr::ToVal() const
 	{ return ToVal(nullptr); }
 
 RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
 	{
-	return ToVal({AdoptRef{}, chain}).release();
+	return ToVal({zeek::AdoptRef{}, chain}).release();
 	}
 
 IPAddr IP_Hdr::IPHeaderSrcAddr() const
@@ -326,22 +326,22 @@ IPAddr IP_Hdr::DstAddr() const
 	return ip4 ? IPAddr(ip4->ip_dst) : ip6_hdrs->DstAddr();
 	}
 
-IntrusivePtr<RecordVal> IP_Hdr::ToIPHdrVal() const
+zeek::IntrusivePtr<RecordVal> IP_Hdr::ToIPHdrVal() const
 	{
-	IntrusivePtr<RecordVal> rval;
+	zeek::IntrusivePtr<RecordVal> rval;
 
 	if ( ip4 )
 		{
 		static auto ip4_hdr_type = zeek::id::find_type<zeek::RecordType>("ip4_hdr");
-		rval = make_intrusive<RecordVal>(ip4_hdr_type);
+		rval = zeek::make_intrusive<RecordVal>(ip4_hdr_type);
 		rval->Assign(0, val_mgr->Count(ip4->ip_hl * 4));
 		rval->Assign(1, val_mgr->Count(ip4->ip_tos));
 		rval->Assign(2, val_mgr->Count(ntohs(ip4->ip_len)));
 		rval->Assign(3, val_mgr->Count(ntohs(ip4->ip_id)));
 		rval->Assign(4, val_mgr->Count(ip4->ip_ttl));
 		rval->Assign(5, val_mgr->Count(ip4->ip_p));
-		rval->Assign(6, make_intrusive<AddrVal>(ip4->ip_src.s_addr));
-		rval->Assign(7, make_intrusive<AddrVal>(ip4->ip_dst.s_addr));
+		rval->Assign(6, zeek::make_intrusive<AddrVal>(ip4->ip_src.s_addr));
+		rval->Assign(7, zeek::make_intrusive<AddrVal>(ip4->ip_dst.s_addr));
 		}
 	else
 		{
@@ -356,10 +356,10 @@ RecordVal* IP_Hdr::BuildIPHdrVal() const
 	return ToIPHdrVal().release();
 	}
 
-IntrusivePtr<RecordVal> IP_Hdr::ToPktHdrVal() const
+zeek::IntrusivePtr<RecordVal> IP_Hdr::ToPktHdrVal() const
 	{
 	static auto pkt_hdr_type = zeek::id::find_type<zeek::RecordType>("pkt_hdr");
-	return ToPktHdrVal(make_intrusive<RecordVal>(pkt_hdr_type), 0);
+	return ToPktHdrVal(zeek::make_intrusive<RecordVal>(pkt_hdr_type), 0);
 	}
 
 RecordVal* IP_Hdr::BuildPktHdrVal() const
@@ -367,7 +367,7 @@ RecordVal* IP_Hdr::BuildPktHdrVal() const
 	return ToPktHdrVal().release();
 	}
 
-IntrusivePtr<RecordVal> IP_Hdr::ToPktHdrVal(IntrusivePtr<RecordVal> pkt_hdr, int sindex) const
+zeek::IntrusivePtr<RecordVal> IP_Hdr::ToPktHdrVal(zeek::IntrusivePtr<RecordVal> pkt_hdr, int sindex) const
 	{
 	static auto tcp_hdr_type = zeek::id::find_type<zeek::RecordType>("tcp_hdr");
 	static auto udp_hdr_type = zeek::id::find_type<zeek::RecordType>("udp_hdr");
@@ -386,7 +386,7 @@ IntrusivePtr<RecordVal> IP_Hdr::ToPktHdrVal(IntrusivePtr<RecordVal> pkt_hdr, int
 	case IPPROTO_TCP:
 		{
 		const struct tcphdr* tp = (const struct tcphdr*) data;
-		auto tcp_hdr = make_intrusive<RecordVal>(tcp_hdr_type);
+		auto tcp_hdr = zeek::make_intrusive<RecordVal>(tcp_hdr_type);
 
 		int tcp_hdr_len = tp->th_off * 4;
 		int data_len = PayloadLen() - tcp_hdr_len;
@@ -408,7 +408,7 @@ IntrusivePtr<RecordVal> IP_Hdr::ToPktHdrVal(IntrusivePtr<RecordVal> pkt_hdr, int
 	case IPPROTO_UDP:
 		{
 		const struct udphdr* up = (const struct udphdr*) data;
-		auto udp_hdr = make_intrusive<RecordVal>(udp_hdr_type);
+		auto udp_hdr = zeek::make_intrusive<RecordVal>(udp_hdr_type);
 
 		udp_hdr->Assign(0, val_mgr->Port(ntohs(up->uh_sport), TRANSPORT_UDP));
 		udp_hdr->Assign(1, val_mgr->Port(ntohs(up->uh_dport), TRANSPORT_UDP));
@@ -421,7 +421,7 @@ IntrusivePtr<RecordVal> IP_Hdr::ToPktHdrVal(IntrusivePtr<RecordVal> pkt_hdr, int
 	case IPPROTO_ICMP:
 		{
 		const struct icmp* icmpp = (const struct icmp *) data;
-		auto icmp_hdr = make_intrusive<RecordVal>(icmp_hdr_type);
+		auto icmp_hdr = zeek::make_intrusive<RecordVal>(icmp_hdr_type);
 
 		icmp_hdr->Assign(0, val_mgr->Count(icmpp->icmp_type));
 
@@ -432,7 +432,7 @@ IntrusivePtr<RecordVal> IP_Hdr::ToPktHdrVal(IntrusivePtr<RecordVal> pkt_hdr, int
 	case IPPROTO_ICMPV6:
 		{
 		const struct icmp6_hdr* icmpp = (const struct icmp6_hdr*) data;
-		auto icmp_hdr = make_intrusive<RecordVal>(icmp_hdr_type);
+		auto icmp_hdr = zeek::make_intrusive<RecordVal>(icmp_hdr_type);
 
 		icmp_hdr->Assign(0, val_mgr->Count(icmpp->icmp6_type));
 
@@ -452,7 +452,7 @@ IntrusivePtr<RecordVal> IP_Hdr::ToPktHdrVal(IntrusivePtr<RecordVal> pkt_hdr, int
 
 RecordVal* IP_Hdr::BuildPktHdrVal(RecordVal* pkt_hdr, int sindex) const
 	{
-	return ToPktHdrVal({AdoptRef{}, pkt_hdr}, sindex).release();
+	return ToPktHdrVal({zeek::AdoptRef{}, pkt_hdr}, sindex).release();
 	}
 
 static inline bool isIPv6ExtHeader(uint8_t type)
@@ -676,7 +676,7 @@ void IPv6_Hdr_Chain::ProcessDstOpts(const struct ip6_dest* d, uint16_t len)
 	}
 #endif
 
-IntrusivePtr<VectorVal> IPv6_Hdr_Chain::ToVal() const
+zeek::IntrusivePtr<VectorVal> IPv6_Hdr_Chain::ToVal() const
 	{
 	static auto ip6_ext_hdr_type = zeek::id::find_type<zeek::RecordType>("ip6_ext_hdr");
 	static auto ip6_hopopts_type = zeek::id::find_type<zeek::RecordType>("ip6_hopopts");
@@ -686,12 +686,12 @@ IntrusivePtr<VectorVal> IPv6_Hdr_Chain::ToVal() const
 	static auto ip6_ah_type = zeek::id::find_type<zeek::RecordType>("ip6_ah");
 	static auto ip6_esp_type = zeek::id::find_type<zeek::RecordType>("ip6_esp");
 	static auto ip6_ext_hdr_chain_type = zeek::id::find_type<zeek::VectorType>("ip6_ext_hdr_chain");
-	auto rval = make_intrusive<VectorVal>(ip6_ext_hdr_chain_type);
+	auto rval = zeek::make_intrusive<VectorVal>(ip6_ext_hdr_chain_type);
 
 	for ( size_t i = 1; i < chain.size(); ++i )
 		{
 		auto v = chain[i]->ToVal();
-		auto ext_hdr = make_intrusive<RecordVal>(ip6_ext_hdr_type);
+		auto ext_hdr = zeek::make_intrusive<RecordVal>(ip6_ext_hdr_type);
 		uint8_t type = chain[i]->Type();
 		ext_hdr->Assign(0, val_mgr->Count(type));
 
diff --git a/src/IP.h b/src/IP.h
index 3bb1a6c897..ffd9c8bbb9 100644
--- a/src/IP.h
+++ b/src/IP.h
@@ -136,8 +136,8 @@ public:
 	/**
 	 * Returns the script-layer record representation of the header.
 	 */
-	IntrusivePtr<RecordVal> ToVal(IntrusivePtr<VectorVal> chain) const;
-	IntrusivePtr<RecordVal> ToVal() const;
+	zeek::IntrusivePtr<RecordVal> ToVal(zeek::IntrusivePtr<VectorVal> chain) const;
+	zeek::IntrusivePtr<RecordVal> ToVal() const;
 
 	[[deprecated("Remove in v4.1.  Use ToVal() instead.")]]
 	RecordVal* BuildRecordVal(VectorVal* chain = nullptr) const;
@@ -229,7 +229,7 @@ public:
 	 * Returns a vector of ip6_ext_hdr RecordVals that includes script-layer
 	 * representation of all extension headers in the chain.
 	 */
-	IntrusivePtr<VectorVal> ToVal() const;
+	zeek::IntrusivePtr<VectorVal> ToVal() const;
 
 	[[deprecated("Remove in v4.1.  Use ToVal() instead.")]]
 	VectorVal* BuildVal() const;
@@ -526,7 +526,7 @@ public:
 	/**
 	 * Returns an ip_hdr or ip6_hdr_chain RecordVal.
 	 */
-	IntrusivePtr<RecordVal> ToIPHdrVal() const;
+	zeek::IntrusivePtr<RecordVal> ToIPHdrVal() const;
 
 	[[deprecated("Remove in v4.1.  Use ToIPHdrVal() instead.")]]
 	RecordVal* BuildIPHdrVal() const;
@@ -535,7 +535,7 @@ public:
 	 * Returns a pkt_hdr RecordVal, which includes not only the IP header, but
 	 * also upper-layer (tcp/udp/icmp) headers.
 	 */
-	IntrusivePtr<RecordVal> ToPktHdrVal() const;
+	zeek::IntrusivePtr<RecordVal> ToPktHdrVal() const;
 
 	[[deprecated("Remove in v4.1.  Use ToPktHdrVal() instead.")]]
 	RecordVal* BuildPktHdrVal() const;
@@ -544,7 +544,7 @@ public:
 	 * Same as above, but simply add our values into the record at the
 	 * specified starting index.
 	 */
-	IntrusivePtr<RecordVal> ToPktHdrVal(IntrusivePtr<RecordVal> pkt_hdr, int sindex) const;
+	zeek::IntrusivePtr<RecordVal> ToPktHdrVal(zeek::IntrusivePtr<RecordVal> pkt_hdr, int sindex) const;
 
 	[[deprecated("Remove in v4.1.  Use ToPktHdrVal() instead.")]]
 	RecordVal* BuildPktHdrVal(RecordVal* pkt_hdr, int sindex) const;
diff --git a/src/IntrusivePtr.h b/src/IntrusivePtr.h
index 6f09bd86cd..f66ba5114a 100644
--- a/src/IntrusivePtr.h
+++ b/src/IntrusivePtr.h
@@ -5,6 +5,8 @@
 #include <type_traits>
 #include <utility>
 
+namespace zeek {
+
 /**
  * A tag class for the #IntrusivePtr constructor which means: adopt
  * the reference from the caller.
@@ -97,7 +99,7 @@ public:
 		}
 
 	IntrusivePtr(const IntrusivePtr& other) noexcept
-		: IntrusivePtr(NewRef{}, other.get())
+		: IntrusivePtr(zeek::NewRef{}, other.get())
 		{
 		}
 
@@ -181,7 +183,7 @@ template <class T, class... Ts>
 IntrusivePtr<T> make_intrusive(Ts&&... args)
 	{
 	// Assumes that objects start with a reference count of 1!
-	return {AdoptRef{}, new T(std::forward<Ts>(args)...)};
+	return {zeek::AdoptRef{}, new T(std::forward<Ts>(args)...)};
 	}
 
 /**
@@ -193,16 +195,18 @@ IntrusivePtr<T> make_intrusive(Ts&&... args)
 template <class T, class U>
 IntrusivePtr<T> cast_intrusive(IntrusivePtr<U> p) noexcept
 	{
-	return {AdoptRef{}, static_cast<T*>(p.release())};
+	return {zeek::AdoptRef{}, static_cast<T*>(p.release())};
 	}
 
+}
+
 // -- comparison to nullptr ----------------------------------------------------
 
 /**
  * @relates IntrusivePtr
  */
 template <class T>
-bool operator==(const IntrusivePtr<T>& x, std::nullptr_t) {
+bool operator==(const zeek::IntrusivePtr<T>& x, std::nullptr_t) {
   return !x;
 }
 
@@ -210,7 +214,7 @@ bool operator==(const IntrusivePtr<T>& x, std::nullptr_t) {
  * @relates IntrusivePtr
  */
 template <class T>
-bool operator==(std::nullptr_t, const IntrusivePtr<T>& x) {
+bool operator==(std::nullptr_t, const zeek::IntrusivePtr<T>& x) {
   return !x;
 }
 
@@ -218,7 +222,7 @@ bool operator==(std::nullptr_t, const IntrusivePtr<T>& x) {
  * @relates IntrusivePtr
  */
 template <class T>
-bool operator!=(const IntrusivePtr<T>& x, std::nullptr_t) {
+bool operator!=(const zeek::IntrusivePtr<T>& x, std::nullptr_t) {
   return static_cast<bool>(x);
 }
 
@@ -226,7 +230,7 @@ bool operator!=(const IntrusivePtr<T>& x, std::nullptr_t) {
  * @relates IntrusivePtr
  */
 template <class T>
-bool operator!=(std::nullptr_t, const IntrusivePtr<T>& x) {
+bool operator!=(std::nullptr_t, const zeek::IntrusivePtr<T>& x) {
   return static_cast<bool>(x);
 }
 
@@ -236,7 +240,7 @@ bool operator!=(std::nullptr_t, const IntrusivePtr<T>& x) {
  * @relates IntrusivePtr
  */
 template <class T>
-bool operator==(const IntrusivePtr<T>& x, const T* y) {
+bool operator==(const zeek::IntrusivePtr<T>& x, const T* y) {
   return x.get() == y;
 }
 
@@ -244,7 +248,7 @@ bool operator==(const IntrusivePtr<T>& x, const T* y) {
  * @relates IntrusivePtr
  */
 template <class T>
-bool operator==(const T* x, const IntrusivePtr<T>& y) {
+bool operator==(const T* x, const zeek::IntrusivePtr<T>& y) {
   return x == y.get();
 }
 
@@ -252,7 +256,7 @@ bool operator==(const T* x, const IntrusivePtr<T>& y) {
  * @relates IntrusivePtr
  */
 template <class T>
-bool operator!=(const IntrusivePtr<T>& x, const T* y) {
+bool operator!=(const zeek::IntrusivePtr<T>& x, const T* y) {
   return x.get() != y;
 }
 
@@ -260,7 +264,7 @@ bool operator!=(const IntrusivePtr<T>& x, const T* y) {
  * @relates IntrusivePtr
  */
 template <class T>
-bool operator!=(const T* x, const IntrusivePtr<T>& y) {
+bool operator!=(const T* x, const zeek::IntrusivePtr<T>& y) {
   return x != y.get();
 }
 
@@ -273,7 +277,7 @@ bool operator!=(const T* x, const IntrusivePtr<T>& y) {
  * @relates IntrusivePtr
  */
 template <class T, class U>
-auto operator==(const IntrusivePtr<T>& x, const IntrusivePtr<U>& y)
+auto operator==(const zeek::IntrusivePtr<T>& x, const zeek::IntrusivePtr<U>& y)
 -> decltype(x.get() == y.get())
 	{
 	return x.get() == y.get();
@@ -283,9 +287,8 @@ auto operator==(const IntrusivePtr<T>& x, const IntrusivePtr<U>& y)
  * @relates IntrusivePtr
  */
 template <class T, class U>
-auto operator!=(const IntrusivePtr<T>& x, const IntrusivePtr<U>& y)
+auto operator!=(const zeek::IntrusivePtr<T>& x, const zeek::IntrusivePtr<U>& y)
 -> decltype(x.get() != y.get())
 	{
 	return x.get() != y.get();
 	}
-
diff --git a/src/Net.cc b/src/Net.cc
index 1574202266..2e56c3df63 100644
--- a/src/Net.cc
+++ b/src/Net.cc
@@ -194,7 +194,7 @@ void net_init(const std::optional<std::string>& interface,
 					     writefile, pkt_dumper->ErrorMsg());
 
 		if ( const auto& id = global_scope()->Find("trace_output_file") )
-			id->SetVal(make_intrusive<StringVal>(writefile));
+			id->SetVal(zeek::make_intrusive<StringVal>(writefile));
 		else
 			reporter->Error("trace_output_file not defined in bro.init");
 		}
diff --git a/src/OpaqueVal.cc b/src/OpaqueVal.cc
index f1d5c50fca..caeb486aca 100644
--- a/src/OpaqueVal.cc
+++ b/src/OpaqueVal.cc
@@ -37,10 +37,10 @@ OpaqueMgr* OpaqueMgr::mgr()
 	return &mgr;
 	}
 
-OpaqueVal::OpaqueVal(zeek::OpaqueType* t) : OpaqueVal({NewRef{}, t})
+OpaqueVal::OpaqueVal(zeek::OpaqueType* t) : OpaqueVal({zeek::NewRef{}, t})
 	{}
 
-OpaqueVal::OpaqueVal(IntrusivePtr<zeek::OpaqueType> t) : Val(std::move(t))
+OpaqueVal::OpaqueVal(zeek::IntrusivePtr<zeek::OpaqueType> t) : Val(std::move(t))
 	{}
 
 OpaqueVal::~OpaqueVal()
@@ -58,7 +58,7 @@ const std::string& OpaqueMgr::TypeID(const OpaqueVal* v) const
 	return x->first;
 	}
 
-IntrusivePtr<OpaqueVal> OpaqueMgr::Instantiate(const std::string& id) const
+zeek::IntrusivePtr<OpaqueVal> OpaqueMgr::Instantiate(const std::string& id) const
 	{
 	auto x = _types.find(id);
 	return x != _types.end() ? (*x->second)() : nullptr;
@@ -75,7 +75,7 @@ broker::expected<broker::data> OpaqueVal::Serialize() const
 	return {broker::vector{std::move(type), std::move(*d)}};
 	}
 
-IntrusivePtr<OpaqueVal> OpaqueVal::Unserialize(const broker::data& data)
+zeek::IntrusivePtr<OpaqueVal> OpaqueVal::Unserialize(const broker::data& data)
 	{
 	auto v = caf::get_if<broker::vector>(&data);
 
@@ -96,7 +96,7 @@ IntrusivePtr<OpaqueVal> OpaqueVal::Unserialize(const broker::data& data)
 	return val;
 	}
 
-broker::expected<broker::data> OpaqueVal::SerializeType(const IntrusivePtr<zeek::Type>& t)
+broker::expected<broker::data> OpaqueVal::SerializeType(const zeek::IntrusivePtr<zeek::Type>& t)
 	{
 	if ( t->InternalType() == zeek::TYPE_INTERNAL_ERROR )
 		return broker::ec::invalid_data;
@@ -112,7 +112,7 @@ broker::expected<broker::data> OpaqueVal::SerializeType(const IntrusivePtr<zeek:
 	return {broker::vector{false, static_cast<uint64_t>(t->Tag())}};
 	}
 
-IntrusivePtr<zeek::Type> OpaqueVal::UnserializeType(const broker::data& data)
+zeek::IntrusivePtr<zeek::Type> OpaqueVal::UnserializeType(const broker::data& data)
 	{
 	auto v = caf::get_if<broker::vector>(&data);
 	if ( ! (v && v->size() == 2) )
@@ -145,7 +145,7 @@ IntrusivePtr<zeek::Type> OpaqueVal::UnserializeType(const broker::data& data)
 	return zeek::base_type(static_cast<zeek::TypeTag>(*tag));
 	}
 
-IntrusivePtr<Val> OpaqueVal::DoClone(CloneState* state)
+zeek::IntrusivePtr<Val> OpaqueVal::DoClone(CloneState* state)
 	{
 	auto d = OpaqueVal::Serialize();
 	if ( ! d )
@@ -169,7 +169,7 @@ bool HashVal::Init()
 	return valid;
 	}
 
-IntrusivePtr<StringVal> HashVal::Get()
+zeek::IntrusivePtr<StringVal> HashVal::Get()
 	{
 	if ( ! valid )
 		return val_mgr->EmptyString();
@@ -200,18 +200,18 @@ bool HashVal::DoFeed(const void*, size_t)
 	return false;
 	}
 
-IntrusivePtr<StringVal> HashVal::DoGet()
+zeek::IntrusivePtr<StringVal> HashVal::DoGet()
 	{
 	assert(! "missing implementation of DoGet()");
 	return val_mgr->EmptyString();
 	}
 
-HashVal::HashVal(IntrusivePtr<zeek::OpaqueType> t) : OpaqueVal(std::move(t))
+HashVal::HashVal(zeek::IntrusivePtr<zeek::OpaqueType> t) : OpaqueVal(std::move(t))
 	{
 	valid = false;
 	}
 
-HashVal::HashVal(zeek::OpaqueType* t) : HashVal({NewRef{}, t})
+HashVal::HashVal(zeek::OpaqueType* t) : HashVal({zeek::NewRef{}, t})
 	{}
 
 MD5Val::MD5Val() : HashVal(md5_type)
@@ -239,14 +239,14 @@ void HashVal::digest_one(EVP_MD_CTX* h, const Val* v)
 		}
 	}
 
-void HashVal::digest_one(EVP_MD_CTX* h, const IntrusivePtr<Val>& v)
+void HashVal::digest_one(EVP_MD_CTX* h, const zeek::IntrusivePtr<Val>& v)
 	{
 	digest_one(h, v.get());
 	}
 
-IntrusivePtr<Val> MD5Val::DoClone(CloneState* state)
+zeek::IntrusivePtr<Val> MD5Val::DoClone(CloneState* state)
 	{
-	auto out = make_intrusive<MD5Val>();
+	auto out = zeek::make_intrusive<MD5Val>();
 
 	if ( IsValid() )
 		{
@@ -275,14 +275,14 @@ bool MD5Val::DoFeed(const void* data, size_t size)
 	return true;
 	}
 
-IntrusivePtr<StringVal> MD5Val::DoGet()
+zeek::IntrusivePtr<StringVal> MD5Val::DoGet()
 	{
 	if ( ! IsValid() )
 		return val_mgr->EmptyString();
 
 	u_char digest[MD5_DIGEST_LENGTH];
 	hash_final(ctx, digest);
-	return make_intrusive<StringVal>(md5_digest_print(digest));
+	return zeek::make_intrusive<StringVal>(md5_digest_print(digest));
 	}
 
 IMPLEMENT_OPAQUE_VALUE(MD5Val)
@@ -364,9 +364,9 @@ SHA1Val::~SHA1Val()
 		EVP_MD_CTX_free(ctx);
 	}
 
-IntrusivePtr<Val> SHA1Val::DoClone(CloneState* state)
+zeek::IntrusivePtr<Val> SHA1Val::DoClone(CloneState* state)
 	{
-	auto out = make_intrusive<SHA1Val>();
+	auto out = zeek::make_intrusive<SHA1Val>();
 
 	if ( IsValid() )
 		{
@@ -395,14 +395,14 @@ bool SHA1Val::DoFeed(const void* data, size_t size)
 	return true;
 	}
 
-IntrusivePtr<StringVal> SHA1Val::DoGet()
+zeek::IntrusivePtr<StringVal> SHA1Val::DoGet()
 	{
 	if ( ! IsValid() )
 		return val_mgr->EmptyString();
 
 	u_char digest[SHA_DIGEST_LENGTH];
 	hash_final(ctx, digest);
-	return make_intrusive<StringVal>(sha1_digest_print(digest));
+	return zeek::make_intrusive<StringVal>(sha1_digest_print(digest));
 	}
 
 IMPLEMENT_OPAQUE_VALUE(SHA1Val)
@@ -487,9 +487,9 @@ SHA256Val::~SHA256Val()
 		EVP_MD_CTX_free(ctx);
 	}
 
-IntrusivePtr<Val> SHA256Val::DoClone(CloneState* state)
+zeek::IntrusivePtr<Val> SHA256Val::DoClone(CloneState* state)
 	{
-	auto out = make_intrusive<SHA256Val>();
+	auto out = zeek::make_intrusive<SHA256Val>();
 
 	if ( IsValid() )
 		{
@@ -518,14 +518,14 @@ bool SHA256Val::DoFeed(const void* data, size_t size)
 	return true;
 	}
 
-IntrusivePtr<StringVal> SHA256Val::DoGet()
+zeek::IntrusivePtr<StringVal> SHA256Val::DoGet()
 	{
 	if ( ! IsValid() )
 		return val_mgr->EmptyString();
 
 	u_char digest[SHA256_DIGEST_LENGTH];
 	hash_final(ctx, digest);
-	return make_intrusive<StringVal>(sha256_digest_print(digest));
+	return zeek::make_intrusive<StringVal>(sha256_digest_print(digest));
 	}
 
 IMPLEMENT_OPAQUE_VALUE(SHA256Val)
@@ -711,26 +711,26 @@ BloomFilterVal::BloomFilterVal(probabilistic::BloomFilter* bf)
 	bloom_filter = bf;
 	}
 
-IntrusivePtr<Val> BloomFilterVal::DoClone(CloneState* state)
+zeek::IntrusivePtr<Val> BloomFilterVal::DoClone(CloneState* state)
 	{
 	if ( bloom_filter )
 		{
-		auto bf = make_intrusive<BloomFilterVal>(bloom_filter->Clone());
+		auto bf = zeek::make_intrusive<BloomFilterVal>(bloom_filter->Clone());
 		bf->Typify(type);
 		return state->NewClone(this, std::move(bf));
 		}
 
-	return state->NewClone(this, make_intrusive<BloomFilterVal>());
+	return state->NewClone(this, zeek::make_intrusive<BloomFilterVal>());
 	}
 
-bool BloomFilterVal::Typify(IntrusivePtr<zeek::Type> arg_type)
+bool BloomFilterVal::Typify(zeek::IntrusivePtr<zeek::Type> arg_type)
 	{
 	if ( type )
 		return false;
 
 	type = std::move(arg_type);
 
-	auto tl = make_intrusive<zeek::TypeList>(type);
+	auto tl = zeek::make_intrusive<zeek::TypeList>(type);
 	tl->Append(type);
 	hash = new CompositeHash(std::move(tl));
 
@@ -765,7 +765,7 @@ std::string BloomFilterVal::InternalState() const
 	return bloom_filter->InternalState();
 	}
 
-IntrusivePtr<BloomFilterVal> BloomFilterVal::Merge(const BloomFilterVal* x,
+zeek::IntrusivePtr<BloomFilterVal> BloomFilterVal::Merge(const BloomFilterVal* x,
                                                    const BloomFilterVal* y)
 	{
 	if ( x->Type() && // any one 0 is ok here
@@ -791,7 +791,7 @@ IntrusivePtr<BloomFilterVal> BloomFilterVal::Merge(const BloomFilterVal* x,
 		return nullptr;
 		}
 
-	auto merged = make_intrusive<BloomFilterVal>(copy);
+	auto merged = zeek::make_intrusive<BloomFilterVal>(copy);
 
 	if ( x->Type() && ! merged->Typify(x->Type()) )
 		{
@@ -876,20 +876,20 @@ CardinalityVal::~CardinalityVal()
 	delete hash;
 	}
 
-IntrusivePtr<Val> CardinalityVal::DoClone(CloneState* state)
+zeek::IntrusivePtr<Val> CardinalityVal::DoClone(CloneState* state)
 	{
 	return state->NewClone(this,
-			       make_intrusive<CardinalityVal>(new probabilistic::CardinalityCounter(*c)));
+			       zeek::make_intrusive<CardinalityVal>(new probabilistic::CardinalityCounter(*c)));
 	}
 
-bool CardinalityVal::Typify(IntrusivePtr<zeek::Type> arg_type)
+bool CardinalityVal::Typify(zeek::IntrusivePtr<zeek::Type> arg_type)
 	{
 	if ( type )
 		return false;
 
 	type = std::move(arg_type);
 
-	auto tl = make_intrusive<zeek::TypeList>(type);
+	auto tl = zeek::make_intrusive<zeek::TypeList>(type);
 	tl->Append(type);
 	hash = new CompositeHash(std::move(tl));
 
@@ -957,14 +957,14 @@ ParaglobVal::ParaglobVal(std::unique_ptr<paraglob::Paraglob> p)
 	this->internal_paraglob = std::move(p);
 	}
 
-IntrusivePtr<VectorVal> ParaglobVal::Get(StringVal* &pattern)
+zeek::IntrusivePtr<VectorVal> ParaglobVal::Get(StringVal* &pattern)
 	{
-	auto rval = make_intrusive<VectorVal>(zeek::id::string_vec);
+	auto rval = zeek::make_intrusive<VectorVal>(zeek::id::string_vec);
 	std::string string_pattern (reinterpret_cast<const char*>(pattern->Bytes()), pattern->Len());
 
 	std::vector<std::string> matches = this->internal_paraglob->get(string_pattern);
 	for (unsigned int i = 0; i < matches.size(); i++)
-		rval->Assign(i, make_intrusive<StringVal>(matches.at(i)));
+		rval->Assign(i, zeek::make_intrusive<StringVal>(matches.at(i)));
 
 	return rval;
 	}
@@ -1018,10 +1018,10 @@ bool ParaglobVal::DoUnserialize(const broker::data& data)
 	return true;
 	}
 
-IntrusivePtr<Val> ParaglobVal::DoClone(CloneState* state)
+zeek::IntrusivePtr<Val> ParaglobVal::DoClone(CloneState* state)
 	{
 	try {
-		return make_intrusive<ParaglobVal>
+		return zeek::make_intrusive<ParaglobVal>
 			(std::make_unique<paraglob::Paraglob>(this->internal_paraglob->serialize()));
 		}
 	catch (const paraglob::underflow_error& e)
diff --git a/src/OpaqueVal.h b/src/OpaqueVal.h
index 848e6bed76..2c9a9a912c 100644
--- a/src/OpaqueVal.h
+++ b/src/OpaqueVal.h
@@ -21,7 +21,7 @@ class OpaqueVal;
   */
 class OpaqueMgr {
 public:
-	using Factory = IntrusivePtr<OpaqueVal> ();
+	using Factory = zeek::IntrusivePtr<OpaqueVal> ();
 
 	/**
 	 * Return's a unique ID for the type of an opaque value.
@@ -45,7 +45,7 @@ public:
 	 * is unknown, this will return null.
 	 *
 	 */
-	IntrusivePtr<OpaqueVal> Instantiate(const std::string& id) const;
+	zeek::IntrusivePtr<OpaqueVal> Instantiate(const std::string& id) const;
 
 	/** Returns the global manager singleton object. */
 	static OpaqueMgr* mgr();
@@ -68,11 +68,11 @@ private:
 /** Macro to insert into an OpaqueVal-derived class's declaration. */
 #define DECLARE_OPAQUE_VALUE(T)                            \
     friend class OpaqueMgr::Register<T>;                   \
-    friend IntrusivePtr<T> make_intrusive<T>();            \
+    friend zeek::IntrusivePtr<T> zeek::make_intrusive<T>();            \
     broker::expected<broker::data> DoSerialize() const override;             \
     bool DoUnserialize(const broker::data& data) override; \
     const char* OpaqueName() const override { return #T; } \
-    static IntrusivePtr<OpaqueVal> OpaqueInstantiate() { return make_intrusive<T>(); }
+    static zeek::IntrusivePtr<OpaqueVal> OpaqueInstantiate() { return zeek::make_intrusive<T>(); }
 
 #define __OPAQUE_MERGE(a, b) a ## b
 #define __OPAQUE_ID(x) __OPAQUE_MERGE(_opaque, x)
@@ -89,7 +89,7 @@ class OpaqueVal : public Val {
 public:
 	[[deprecated("Remove in v4.1.  Construct from IntrusivePtr instead.")]]
 	explicit OpaqueVal(zeek::OpaqueType* t);
-	explicit OpaqueVal(IntrusivePtr<zeek::OpaqueType> t);
+	explicit OpaqueVal(zeek::IntrusivePtr<zeek::OpaqueType> t);
 	~OpaqueVal() override;
 
 	/**
@@ -106,7 +106,7 @@ public:
 	 * @param data Broker representation as returned by *Serialize()*.
 	 * @return unserialized instances with reference count at +1
 	 */
-	static IntrusivePtr<OpaqueVal> Unserialize(const broker::data& data);
+	static zeek::IntrusivePtr<OpaqueVal> Unserialize(const broker::data& data);
 
 protected:
 	friend class Val;
@@ -142,19 +142,19 @@ protected:
 	 * may also override this with a more efficient custom clone
 	 * implementation of their own.
 	 */
-	IntrusivePtr<Val> DoClone(CloneState* state) override;
+	zeek::IntrusivePtr<Val> DoClone(CloneState* state) override;
 
 	/**
 	 * Helper function for derived class that need to record a type
 	 * during serialization.
 	 */
-	static broker::expected<broker::data> SerializeType(const IntrusivePtr<zeek::Type>& t);
+	static broker::expected<broker::data> SerializeType(const zeek::IntrusivePtr<zeek::Type>& t);
 
 	/**
 	 * Helper function for derived class that need to restore a type
 	 * during unserialization. Returns the type at reference count +1.
 	 */
-	static IntrusivePtr<zeek::Type> UnserializeType(const broker::data& data);
+	static zeek::IntrusivePtr<zeek::Type> UnserializeType(const broker::data& data);
 };
 
 namespace probabilistic {
@@ -178,21 +178,21 @@ public:
 	bool IsValid() const;
 	bool Init();
 	bool Feed(const void* data, size_t size);
-	IntrusivePtr<StringVal> Get();
+	zeek::IntrusivePtr<StringVal> Get();
 
 protected:
 	static void digest_one(EVP_MD_CTX* h, const Val* v);
-	static void digest_one(EVP_MD_CTX* h, const IntrusivePtr<Val>& v);
+	static void digest_one(EVP_MD_CTX* h, const zeek::IntrusivePtr<Val>& v);
 
 	HashVal()	{ valid = false; }
 
 	[[deprecated("Remove in v4.1. Construct from IntrusivePtr instead.")]]
 	explicit HashVal(zeek::OpaqueType* t);
-	explicit HashVal(IntrusivePtr<zeek::OpaqueType> t);
+	explicit HashVal(zeek::IntrusivePtr<zeek::OpaqueType> t);
 
 	virtual bool DoInit();
 	virtual bool DoFeed(const void* data, size_t size);
-	virtual IntrusivePtr<StringVal> DoGet();
+	virtual zeek::IntrusivePtr<StringVal> DoGet();
 
 private:
 	// This flag exists because Get() can only be called once.
@@ -221,14 +221,14 @@ public:
 	MD5Val();
 	~MD5Val();
 
-	IntrusivePtr<Val> DoClone(CloneState* state) override;
+	zeek::IntrusivePtr<Val> DoClone(CloneState* state) override;
 
 protected:
 	friend class Val;
 
 	bool DoInit() override;
 	bool DoFeed(const void* data, size_t size) override;
-	IntrusivePtr<StringVal> DoGet() override;
+	zeek::IntrusivePtr<StringVal> DoGet() override;
 
 	DECLARE_OPAQUE_VALUE(MD5Val)
 private:
@@ -244,14 +244,14 @@ public:
 	SHA1Val();
 	~SHA1Val();
 
-	IntrusivePtr<Val> DoClone(CloneState* state) override;
+	zeek::IntrusivePtr<Val> DoClone(CloneState* state) override;
 
 protected:
 	friend class Val;
 
 	bool DoInit() override;
 	bool DoFeed(const void* data, size_t size) override;
-	IntrusivePtr<StringVal> DoGet() override;
+	zeek::IntrusivePtr<StringVal> DoGet() override;
 
 	DECLARE_OPAQUE_VALUE(SHA1Val)
 private:
@@ -267,14 +267,14 @@ public:
 	SHA256Val();
 	~SHA256Val();
 
-	IntrusivePtr<Val> DoClone(CloneState* state) override;
+	zeek::IntrusivePtr<Val> DoClone(CloneState* state) override;
 
 protected:
 	friend class Val;
 
 	bool DoInit() override;
 	bool DoFeed(const void* data, size_t size) override;
-	IntrusivePtr<StringVal> DoGet() override;
+	zeek::IntrusivePtr<StringVal> DoGet() override;
 
 	DECLARE_OPAQUE_VALUE(SHA256Val)
 private:
@@ -302,12 +302,12 @@ public:
 	explicit BloomFilterVal(probabilistic::BloomFilter* bf);
 	~BloomFilterVal() override;
 
-	IntrusivePtr<Val> DoClone(CloneState* state) override;
+	zeek::IntrusivePtr<Val> DoClone(CloneState* state) override;
 
-	const IntrusivePtr<zeek::Type>& Type() const
+	const zeek::IntrusivePtr<zeek::Type>& Type() const
 		{ return type; }
 
-	bool Typify(IntrusivePtr<zeek::Type> type);
+	bool Typify(zeek::IntrusivePtr<zeek::Type> type);
 
 	void Add(const Val* val);
 	size_t Count(const Val* val) const;
@@ -315,7 +315,7 @@ public:
 	bool Empty() const;
 	std::string InternalState() const;
 
-	static IntrusivePtr<BloomFilterVal> Merge(const BloomFilterVal* x,
+	static zeek::IntrusivePtr<BloomFilterVal> Merge(const BloomFilterVal* x,
 	                                          const BloomFilterVal* y);
 
 protected:
@@ -328,7 +328,7 @@ private:
 	BloomFilterVal(const BloomFilterVal&);
 	BloomFilterVal& operator=(const BloomFilterVal&);
 
-	IntrusivePtr<zeek::Type> type;
+	zeek::IntrusivePtr<zeek::Type> type;
 	CompositeHash* hash;
 	probabilistic::BloomFilter* bloom_filter;
 };
@@ -339,14 +339,14 @@ public:
 	explicit CardinalityVal(probabilistic::CardinalityCounter*);
 	~CardinalityVal() override;
 
-	IntrusivePtr<Val> DoClone(CloneState* state) override;
+	zeek::IntrusivePtr<Val> DoClone(CloneState* state) override;
 
 	void Add(const Val* val);
 
-	const IntrusivePtr<zeek::Type>& Type() const
+	const zeek::IntrusivePtr<zeek::Type>& Type() const
 		{ return type; }
 
-	bool Typify(IntrusivePtr<zeek::Type> type);
+	bool Typify(zeek::IntrusivePtr<zeek::Type> type);
 
 	probabilistic::CardinalityCounter* Get()	{ return c; };
 
@@ -355,7 +355,7 @@ protected:
 
 	DECLARE_OPAQUE_VALUE(CardinalityVal)
 private:
-	IntrusivePtr<zeek::Type> type;
+	zeek::IntrusivePtr<zeek::Type> type;
 	CompositeHash* hash;
 	probabilistic::CardinalityCounter* c;
 };
@@ -363,8 +363,8 @@ private:
 class ParaglobVal : public OpaqueVal {
 public:
 	explicit ParaglobVal(std::unique_ptr<paraglob::Paraglob> p);
-	IntrusivePtr<VectorVal> Get(StringVal* &pattern);
-	IntrusivePtr<Val> DoClone(CloneState* state) override;
+	zeek::IntrusivePtr<VectorVal> Get(StringVal* &pattern);
+	zeek::IntrusivePtr<Val> DoClone(CloneState* state) override;
 	bool operator==(const ParaglobVal& other) const;
 
 protected:
diff --git a/src/Reporter.cc b/src/Reporter.cc
index 467ab7e0bf..32f5a8f943 100644
--- a/src/Reporter.cc
+++ b/src/Reporter.cc
@@ -417,7 +417,7 @@ void Reporter::Weird(Connection* conn, const char* name, const char* addl)
 	            "%s", name);
 	}
 
-void Reporter::Weird(IntrusivePtr<RecordVal> conn_id, IntrusivePtr<StringVal> uid,
+void Reporter::Weird(zeek::IntrusivePtr<RecordVal> conn_id, zeek::IntrusivePtr<StringVal> uid,
                      const char* name, const char* addl)
 	{
 	UpdateWeirdStats(name);
@@ -558,19 +558,19 @@ void Reporter::DoLog(const char* prefix, EventHandlerPtr event, FILE* out,
 		vl.reserve(vl_size);
 
 		if ( time )
-			vl.emplace_back(make_intrusive<TimeVal>(network_time ? network_time : current_time()));
+			vl.emplace_back(zeek::make_intrusive<TimeVal>(network_time ? network_time : current_time()));
 
-		vl.emplace_back(make_intrusive<StringVal>(buffer));
+		vl.emplace_back(zeek::make_intrusive<StringVal>(buffer));
 
 		if ( location )
-			vl.emplace_back(make_intrusive<StringVal>(loc_str.c_str()));
+			vl.emplace_back(zeek::make_intrusive<StringVal>(loc_str.c_str()));
 
 		if ( conn )
 			vl.emplace_back(conn->ConnVal());
 
 		if ( addl )
 			for ( auto v : *addl )
-				vl.emplace_back(AdoptRef{}, v);
+				vl.emplace_back(zeek::AdoptRef{}, v);
 
 		if ( conn )
 			conn->EnqueueEvent(event, nullptr, std::move(vl));
diff --git a/src/Reporter.h b/src/Reporter.h
index 0c09dfd722..7a71264464 100644
--- a/src/Reporter.h
+++ b/src/Reporter.h
@@ -24,7 +24,9 @@ class EventHandlerPtr;
 class RecordVal;
 class StringVal;
 
+namespace zeek {
 template <class T> class IntrusivePtr;
+}
 
 // One cannot raise this exception directly, go through the
 // Reporter's methods instead.
@@ -97,7 +99,7 @@ public:
 	void Weird(const char* name, const char* addl = "");	// Raises net_weird().
 	void Weird(file_analysis::File* f, const char* name, const char* addl = "");	// Raises file_weird().
 	void Weird(Connection* conn, const char* name, const char* addl = "");	// Raises conn_weird().
-	void Weird(IntrusivePtr<RecordVal> conn_id, IntrusivePtr<StringVal> uid,
+	void Weird(zeek::IntrusivePtr<RecordVal> conn_id, zeek::IntrusivePtr<StringVal> uid,
 	           const char* name, const char* addl = "");	// Raises expired_conn_weird().
 	void Weird(const IPAddr& orig, const IPAddr& resp, const char* name, const char* addl = "");	// Raises flow_weird().
 
diff --git a/src/RuleAction.cc b/src/RuleAction.cc
index 031fa0e6b2..fdca6f3472 100644
--- a/src/RuleAction.cc
+++ b/src/RuleAction.cc
@@ -22,9 +22,9 @@ void RuleActionEvent::DoAction(const Rule* parent, RuleEndpointState* state,
 	{
 	if ( signature_match )
 		mgr.Enqueue(signature_match,
-			IntrusivePtr{AdoptRef{}, rule_matcher->BuildRuleStateValue(parent, state)},
-			make_intrusive<StringVal>(msg),
-			data ? make_intrusive<StringVal>(len, (const char*)data) : val_mgr->EmptyString()
+		            zeek::IntrusivePtr{zeek::AdoptRef{}, rule_matcher->BuildRuleStateValue(parent, state)},
+		            zeek::make_intrusive<StringVal>(msg),
+		            data ? zeek::make_intrusive<StringVal>(len, (const char*)data) : val_mgr->EmptyString()
 		);
 	}
 
diff --git a/src/RuleCondition.cc b/src/RuleCondition.cc
index 2735a876b0..a0f86194e4 100644
--- a/src/RuleCondition.cc
+++ b/src/RuleCondition.cc
@@ -170,10 +170,10 @@ bool RuleConditionEval::DoMatch(Rule* rule, RuleEndpointState* state,
 	// Call function with a signature_state value as argument.
 	zeek::Args args;
 	args.reserve(2);
-	args.emplace_back(AdoptRef{}, rule_matcher->BuildRuleStateValue(rule, state));
+	args.emplace_back(zeek::AdoptRef{}, rule_matcher->BuildRuleStateValue(rule, state));
 
 	if ( data )
-		args.emplace_back(make_intrusive<StringVal>(len, (const char*) data));
+		args.emplace_back(zeek::make_intrusive<StringVal>(len, (const char*) data));
 	else
 		args.emplace_back(val_mgr->EmptyString());
 
diff --git a/src/RuleMatcher.cc b/src/RuleMatcher.cc
index 3a314fde1f..ef0d9218d0 100644
--- a/src/RuleMatcher.cc
+++ b/src/RuleMatcher.cc
@@ -83,7 +83,7 @@ Val* RuleMatcher::BuildRuleStateValue(const Rule* rule,
 	{
 	static auto signature_state = zeek::id::find_type<zeek::RecordType>("signature_state");
 	RecordVal* val = new RecordVal(signature_state);
-	val->Assign(0, make_intrusive<StringVal>(rule->ID()));
+	val->Assign(0, zeek::make_intrusive<StringVal>(rule->ID()));
 	val->Assign(1, state->GetAnalyzer()->ConnVal());
 	val->Assign(2, val_mgr->Bool(state->is_orig));
 	val->Assign(3, val_mgr->Count(state->payload_size));
diff --git a/src/Scope.cc b/src/Scope.cc
index fe0695d014..c3cef0501e 100644
--- a/src/Scope.cc
+++ b/src/Scope.cc
@@ -15,8 +15,8 @@ typedef PList<Scope> scope_list;
 static scope_list scopes;
 static Scope* top_scope;
 
-Scope::Scope(IntrusivePtr<zeek::detail::ID> id,
-             std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>> al)
+Scope::Scope(zeek::IntrusivePtr<zeek::detail::ID> id,
+             std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>> al)
 	: scope_id(std::move(id)), attrs(std::move(al))
 	{
 	return_type = nullptr;
@@ -35,7 +35,7 @@ Scope::Scope(IntrusivePtr<zeek::detail::ID> id,
 		}
 	}
 
-const IntrusivePtr<zeek::detail::ID>& Scope::Find(std::string_view name) const
+const zeek::IntrusivePtr<zeek::detail::ID>& Scope::Find(std::string_view name) const
 	{
 	auto entry = local.find(name);
 
@@ -45,7 +45,7 @@ const IntrusivePtr<zeek::detail::ID>& Scope::Find(std::string_view name) const
 	return zeek::detail::ID::nil;
 	}
 
-IntrusivePtr<zeek::detail::ID> Scope::Remove(std::string_view name)
+zeek::IntrusivePtr<zeek::detail::ID> Scope::Remove(std::string_view name)
 	{
 	auto entry = local.find(name);
 
@@ -59,12 +59,12 @@ IntrusivePtr<zeek::detail::ID> Scope::Remove(std::string_view name)
 	return nullptr;
 	}
 
-IntrusivePtr<zeek::detail::ID> Scope::GenerateTemporary(const char* name)
+zeek::IntrusivePtr<zeek::detail::ID> Scope::GenerateTemporary(const char* name)
 	{
-	return make_intrusive<zeek::detail::ID>(name, zeek::detail::SCOPE_FUNCTION, false);
+	return zeek::make_intrusive<zeek::detail::ID>(name, zeek::detail::SCOPE_FUNCTION, false);
 	}
 
-std::vector<IntrusivePtr<zeek::detail::ID>> Scope::GetInits()
+std::vector<zeek::IntrusivePtr<zeek::detail::ID>> Scope::GetInits()
 	{
 	auto rval = std::move(inits);
 	inits = {};
@@ -119,9 +119,10 @@ TraversalCode Scope::Traverse(TraversalCallback* cb) const
 	}
 
 
-const IntrusivePtr<zeek::detail::ID>& lookup_ID(const char* name, const char* curr_module,
-                                                bool no_global, bool same_module_only,
-                                                bool check_export)
+const zeek::IntrusivePtr<zeek::detail::ID>& lookup_ID(
+	const char* name, const char* curr_module,
+	bool no_global, bool same_module_only,
+	bool check_export)
 	{
 	std::string fullname = make_full_var_name(curr_module, name);
 
@@ -153,8 +154,9 @@ const IntrusivePtr<zeek::detail::ID>& lookup_ID(const char* name, const char* cu
 	return zeek::detail::ID::nil;
 	}
 
-IntrusivePtr<zeek::detail::ID> install_ID(const char* name, const char* module_name,
-                            bool is_global, bool is_export)
+zeek::IntrusivePtr<zeek::detail::ID> install_ID(
+	const char* name, const char* module_name,
+	bool is_global, bool is_export)
 	{
 	if ( scopes.empty() && ! is_global )
 		reporter->InternalError("local identifier in global scope");
@@ -171,7 +173,7 @@ IntrusivePtr<zeek::detail::ID> install_ID(const char* name, const char* module_n
 
 	std::string full_name = make_full_var_name(module_name, name);
 
-	auto id = make_intrusive<zeek::detail::ID>(full_name.data(), scope, is_export);
+	auto id = zeek::make_intrusive<zeek::detail::ID>(full_name.data(), scope, is_export);
 
 	if ( zeek::detail::SCOPE_FUNCTION != scope )
 		global_scope()->Insert(std::move(full_name), id);
@@ -189,14 +191,14 @@ void push_existing_scope(Scope* scope)
 	scopes.push_back(scope);
 	}
 
-void push_scope(IntrusivePtr<zeek::detail::ID> id,
-                std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>> attrs)
+void push_scope(zeek::IntrusivePtr<zeek::detail::ID> id,
+                std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>> attrs)
 	{
 	top_scope = new Scope(std::move(id), std::move(attrs));
 	scopes.push_back(top_scope);
 	}
 
-IntrusivePtr<Scope> pop_scope()
+zeek::IntrusivePtr<Scope> pop_scope()
 	{
 	if ( scopes.empty() )
 		reporter->InternalError("scope underflow");
@@ -206,7 +208,7 @@ IntrusivePtr<Scope> pop_scope()
 
 	top_scope = scopes.empty() ? nullptr : scopes.back();
 
-	return {AdoptRef{}, old_top};
+	return {zeek::AdoptRef{}, old_top};
 	}
 
 Scope* current_scope()
diff --git a/src/Scope.h b/src/Scope.h
index 0d09b9033c..86726eb172 100644
--- a/src/Scope.h
+++ b/src/Scope.h
@@ -21,10 +21,10 @@ ZEEK_FORWARD_DECLARE_NAMESPACED(ID, zeek::detail);
 
 class Scope : public BroObj {
 public:
-	explicit Scope(IntrusivePtr<zeek::detail::ID> id,
-	               std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>> al);
+	explicit Scope(zeek::IntrusivePtr<zeek::detail::ID> id,
+	               std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>> al);
 
-	const IntrusivePtr<zeek::detail::ID>& Find(std::string_view name) const;
+	const zeek::IntrusivePtr<zeek::detail::ID>& Find(std::string_view name) const;
 
 	template<typename N>
 	[[deprecated("Remove in v4.1.  Use Find().")]]
@@ -34,34 +34,34 @@ public:
 	template<typename N, typename I>
 	void Insert(N&& name, I&& id) { local[std::forward<N>(name)] = std::forward<I>(id); }
 
-	IntrusivePtr<zeek::detail::ID> Remove(std::string_view name);
+	zeek::IntrusivePtr<zeek::detail::ID> Remove(std::string_view name);
 
 	[[deprecated("Remove in v4.1.  Use GetID().")]]
 	zeek::detail::ID* ScopeID() const		{ return scope_id.get(); }
 
-	const IntrusivePtr<zeek::detail::ID>& GetID() const
+	const zeek::IntrusivePtr<zeek::detail::ID>& GetID() const
 		{ return scope_id; }
 
-	const std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>>& Attrs() const
+	const std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>>& Attrs() const
 		{ return attrs; }
 
 	[[deprecated("Remove in v4.1.  Use GetReturnTrype().")]]
 	zeek::Type* ReturnType() const	{ return return_type.get(); }
 
-	const IntrusivePtr<zeek::Type>& GetReturnType() const
+	const zeek::IntrusivePtr<zeek::Type>& GetReturnType() const
 		{ return return_type; }
 
 	size_t Length() const		{ return local.size(); }
 	const auto& Vars()	{ return local; }
 
-	IntrusivePtr<zeek::detail::ID> GenerateTemporary(const char* name);
+	zeek::IntrusivePtr<zeek::detail::ID> GenerateTemporary(const char* name);
 
 	// Returns the list of variables needing initialization, and
 	// removes it from this Scope.
-	std::vector<IntrusivePtr<zeek::detail::ID>> GetInits();
+	std::vector<zeek::IntrusivePtr<zeek::detail::ID>> GetInits();
 
 	// Adds a variable to the list.
-	void AddInit(IntrusivePtr<zeek::detail::ID> id)
+	void AddInit(zeek::IntrusivePtr<zeek::detail::ID> id)
 		{ inits.emplace_back(std::move(id)); }
 
 	void Describe(ODesc* d) const override;
@@ -69,31 +69,33 @@ public:
 	TraversalCode Traverse(TraversalCallback* cb) const;
 
 protected:
-	IntrusivePtr<zeek::detail::ID> scope_id;
-	std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>> attrs;
-	IntrusivePtr<zeek::Type> return_type;
-	std::map<std::string, IntrusivePtr<zeek::detail::ID>, std::less<>> local;
-	std::vector<IntrusivePtr<zeek::detail::ID>> inits;
+	zeek::IntrusivePtr<zeek::detail::ID> scope_id;
+	std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>> attrs;
+	zeek::IntrusivePtr<zeek::Type> return_type;
+	std::map<std::string, zeek::IntrusivePtr<zeek::detail::ID>, std::less<>> local;
+	std::vector<zeek::IntrusivePtr<zeek::detail::ID>> inits;
 };
 
 
 extern bool in_debug;
 
 // If no_global is true, don't search in the default "global" namespace.
-extern const IntrusivePtr<zeek::detail::ID>& lookup_ID(const char* name, const char* module,
-                                                       bool no_global = false,
-                                                       bool same_module_only = false,
-                                                       bool check_export = true);
+extern const zeek::IntrusivePtr<zeek::detail::ID>& lookup_ID(
+	const char* name, const char* module,
+	bool no_global = false,
+	bool same_module_only = false,
+	bool check_export = true);
 
-extern IntrusivePtr<zeek::detail::ID> install_ID(const char* name, const char* module_name,
-                                                 bool is_global, bool is_export);
+extern zeek::IntrusivePtr<zeek::detail::ID> install_ID(
+	const char* name, const char* module_name,
+	bool is_global, bool is_export);
 
-extern void push_scope(IntrusivePtr<zeek::detail::ID> id,
-                       std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>> attrs);
+extern void push_scope(zeek::IntrusivePtr<zeek::detail::ID> id,
+                       std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>> attrs);
 extern void push_existing_scope(Scope* scope);
 
 // Returns the one popped off.
-extern IntrusivePtr<Scope> pop_scope();
+extern zeek::IntrusivePtr<Scope> pop_scope();
 extern Scope* current_scope();
 extern Scope* global_scope();
 
diff --git a/src/Sessions.cc b/src/Sessions.cc
index c1981b3628..836ec66400 100644
--- a/src/Sessions.cc
+++ b/src/Sessions.cc
@@ -703,7 +703,7 @@ void NetSessions::DoNextPacket(double t, const Packet* pkt, const IP_Hdr* ip_hdr
 
 	conn->CheckFlowLabel(is_orig, ip_hdr->FlowLabel());
 
-	IntrusivePtr<Val> pkt_hdr_val;
+	zeek::IntrusivePtr<Val> pkt_hdr_val;
 
 	if ( ipv6_ext_headers && ip_hdr->NumHeaders() > 1 )
 		{
diff --git a/src/SmithWaterman.cc b/src/SmithWaterman.cc
index f77f790055..0157c28470 100644
--- a/src/SmithWaterman.cc
+++ b/src/SmithWaterman.cc
@@ -63,7 +63,7 @@ VectorVal* BroSubstring::VecToPolicy(Vec* vec)
 	static auto sw_align_vec_type = zeek::id::find_type<zeek::VectorType>("sw_align_vec");
 	static auto sw_substring_vec_type = zeek::id::find_type<zeek::VectorType>("sw_substring_vec");
 
-	auto result = make_intrusive<VectorVal>(sw_substring_vec_type);
+	auto result = zeek::make_intrusive<VectorVal>(sw_substring_vec_type);
 
 	if ( vec )
 		{
@@ -71,17 +71,17 @@ VectorVal* BroSubstring::VecToPolicy(Vec* vec)
 			{
 			BroSubstring* bst = (*vec)[i];
 
-			auto st_val = make_intrusive<RecordVal>(sw_substring_type);
-			st_val->Assign(0, make_intrusive<StringVal>(new BroString(*bst)));
+			auto st_val = zeek::make_intrusive<RecordVal>(sw_substring_type);
+			st_val->Assign(0, zeek::make_intrusive<StringVal>(new BroString(*bst)));
 
-			auto aligns = make_intrusive<VectorVal>(sw_align_vec_type);
+			auto aligns = zeek::make_intrusive<VectorVal>(sw_align_vec_type);
 
 			for ( unsigned int j = 0; j < bst->GetNumAlignments(); ++j )
 				{
 				const BSSAlign& align = (bst->GetAlignments())[j];
 
-				auto align_val = make_intrusive<RecordVal>(sw_align_type);
-				align_val->Assign(0, make_intrusive<StringVal>(new BroString(*align.string)));
+				auto align_val = zeek::make_intrusive<RecordVal>(sw_align_type);
+				align_val->Assign(0, zeek::make_intrusive<StringVal>(new BroString(*align.string)));
 				align_val->Assign(1, val_mgr->Count(align.index));
 
 				aligns->Assign(j + 1, std::move(align_val));
diff --git a/src/Stats.cc b/src/Stats.cc
index 759f95972b..c9dfa5918b 100644
--- a/src/Stats.cc
+++ b/src/Stats.cc
@@ -313,9 +313,9 @@ void ProfileLogger::Log()
 	if ( profiling_update )
 		{
 		mgr.Dispatch(new Event(profiling_update, {
-			make_intrusive<Val>(IntrusivePtr{NewRef{}, file}),
-			val_mgr->Bool(expensive),
-		}));
+					zeek::make_intrusive<Val>(zeek::IntrusivePtr{zeek::NewRef{}, file}),
+					val_mgr->Bool(expensive),
+					}));
 		}
 	}
 
@@ -344,7 +344,7 @@ SampleLogger::SampleLogger()
 	if ( ! load_sample_info )
 		load_sample_info = zeek::id::find_type("load_sample_info")->AsTableType();
 
-	load_samples = new TableVal({NewRef{}, load_sample_info});
+	load_samples = new TableVal({zeek::NewRef{}, load_sample_info});
 	}
 
 SampleLogger::~SampleLogger()
@@ -354,13 +354,13 @@ SampleLogger::~SampleLogger()
 
 void SampleLogger::FunctionSeen(const Func* func)
 	{
-	auto idx = make_intrusive<StringVal>(func->Name());
+	auto idx = zeek::make_intrusive<StringVal>(func->Name());
 	load_samples->Assign(std::move(idx), nullptr);
 	}
 
 void SampleLogger::LocationSeen(const Location* loc)
 	{
-	auto idx = make_intrusive<StringVal>(loc->filename);
+	auto idx = zeek::make_intrusive<StringVal>(loc->filename);
 	load_samples->Assign(std::move(idx), nullptr);
 	}
 
@@ -370,9 +370,9 @@ void SampleLogger::SegmentProfile(const char* /* name */,
 	{
 	if ( load_sample )
 		mgr.Enqueue(load_sample,
-			IntrusivePtr{NewRef{}, load_samples},
-			make_intrusive<IntervalVal>(dtime, Seconds),
-			val_mgr->Int(dmem)
+		            zeek::IntrusivePtr{zeek::NewRef{}, load_samples},
+		            zeek::make_intrusive<IntervalVal>(dtime, Seconds),
+		            val_mgr->Int(dmem)
 		);
 	}
 
diff --git a/src/Stmt.cc b/src/Stmt.cc
index a7919e52b2..b4e2b81764 100644
--- a/src/Stmt.cc
+++ b/src/Stmt.cc
@@ -133,7 +133,7 @@ void Stmt::AccessStats(ODesc* d) const
 		}
 	}
 
-ExprListStmt::ExprListStmt(BroStmtTag t, IntrusivePtr<ListExpr> arg_l)
+ExprListStmt::ExprListStmt(BroStmtTag t, zeek::IntrusivePtr<ListExpr> arg_l)
 	: Stmt(t), l(std::move(arg_l))
 	{
 	const expr_list& e = l->Exprs();
@@ -149,7 +149,7 @@ ExprListStmt::ExprListStmt(BroStmtTag t, IntrusivePtr<ListExpr> arg_l)
 
 ExprListStmt::~ExprListStmt() = default;
 
-IntrusivePtr<Val> ExprListStmt::Exec(Frame* f, stmt_flow_type& flow) const
+zeek::IntrusivePtr<Val> ExprListStmt::Exec(Frame* f, stmt_flow_type& flow) const
 	{
 	last_access = network_time;
 	flow = FLOW_NEXT;
@@ -187,7 +187,7 @@ TraversalCode ExprListStmt::Traverse(TraversalCallback* cb) const
 
 static BroFile* print_stdout = nullptr;
 
-static IntrusivePtr<EnumVal> lookup_enum_val(const char* module_name, const char* name)
+static zeek::IntrusivePtr<EnumVal> lookup_enum_val(const char* module_name, const char* name)
 	{
 	const auto& id = lookup_ID(name, module_name);
 	assert(id);
@@ -201,26 +201,26 @@ static IntrusivePtr<EnumVal> lookup_enum_val(const char* module_name, const char
 	return et->GetVal(index);
 	}
 
-static void print_log(const std::vector<IntrusivePtr<Val>>& vals)
+static void print_log(const std::vector<zeek::IntrusivePtr<Val>>& vals)
 	{
 	static auto plval = lookup_enum_val("Log", "PRINTLOG");
 	static auto lpli = zeek::id::find_type<RecordType>("Log::PrintLogInfo");
-	auto record = make_intrusive<RecordVal>(lpli);
-	auto vec = make_intrusive<VectorVal>(zeek::id::string_vec);
+	auto record = zeek::make_intrusive<RecordVal>(lpli);
+	auto vec = zeek::make_intrusive<VectorVal>(zeek::id::string_vec);
 
 	for ( const auto& val : vals )
 		{
 		ODesc d(DESC_READABLE);
 		val->Describe(&d);
-		vec->Assign(vec->Size(), make_intrusive<StringVal>(d.Description()));
+		vec->Assign(vec->Size(), zeek::make_intrusive<StringVal>(d.Description()));
 		}
 
-	record->Assign(0, make_intrusive<TimeVal>(network_time));
+	record->Assign(0, zeek::make_intrusive<TimeVal>(network_time));
 	record->Assign(1, std::move(vec));
 	log_mgr->Write(plval.get(), record.get());
 	}
 
-IntrusivePtr<Val> PrintStmt::DoExec(std::vector<IntrusivePtr<Val>> vals,
+zeek::IntrusivePtr<Val> PrintStmt::DoExec(std::vector<zeek::IntrusivePtr<Val>> vals,
                                     stmt_flow_type& /* flow */) const
 	{
 	RegisterAccess();
@@ -290,7 +290,7 @@ IntrusivePtr<Val> PrintStmt::DoExec(std::vector<IntrusivePtr<Val>> vals,
 	return nullptr;
 	}
 
-ExprStmt::ExprStmt(IntrusivePtr<Expr> arg_e) : Stmt(STMT_EXPR), e(std::move(arg_e))
+ExprStmt::ExprStmt(zeek::IntrusivePtr<Expr> arg_e) : Stmt(STMT_EXPR), e(std::move(arg_e))
 	{
 	if ( e && e->IsPure() )
 		Warn("expression value ignored");
@@ -298,7 +298,7 @@ ExprStmt::ExprStmt(IntrusivePtr<Expr> arg_e) : Stmt(STMT_EXPR), e(std::move(arg_
 	SetLocationInfo(e->GetLocationInfo());
 	}
 
-ExprStmt::ExprStmt(BroStmtTag t, IntrusivePtr<Expr> arg_e) : Stmt(t), e(std::move(arg_e))
+ExprStmt::ExprStmt(BroStmtTag t, zeek::IntrusivePtr<Expr> arg_e) : Stmt(t), e(std::move(arg_e))
 	{
 	if ( e )
 		SetLocationInfo(e->GetLocationInfo());
@@ -306,7 +306,7 @@ ExprStmt::ExprStmt(BroStmtTag t, IntrusivePtr<Expr> arg_e) : Stmt(t), e(std::mov
 
 ExprStmt::~ExprStmt() = default;
 
-IntrusivePtr<Val> ExprStmt::Exec(Frame* f, stmt_flow_type& flow) const
+zeek::IntrusivePtr<Val> ExprStmt::Exec(Frame* f, stmt_flow_type& flow) const
 	{
 	RegisterAccess();
 	flow = FLOW_NEXT;
@@ -319,7 +319,7 @@ IntrusivePtr<Val> ExprStmt::Exec(Frame* f, stmt_flow_type& flow) const
 		return nullptr;
 	}
 
-IntrusivePtr<Val> ExprStmt::DoExec(Frame* /* f */, Val* /* v */, stmt_flow_type& /* flow */) const
+zeek::IntrusivePtr<Val> ExprStmt::DoExec(Frame* /* f */, Val* /* v */, stmt_flow_type& /* flow */) const
 	{
 	return nullptr;
 	}
@@ -365,8 +365,9 @@ TraversalCode ExprStmt::Traverse(TraversalCallback* cb) const
 	HANDLE_TC_STMT_POST(tc);
 	}
 
-IfStmt::IfStmt(IntrusivePtr<Expr> test,
-               IntrusivePtr<Stmt> arg_s1, IntrusivePtr<Stmt> arg_s2)
+IfStmt::IfStmt(zeek::IntrusivePtr<Expr> test,
+               zeek::IntrusivePtr<Stmt> arg_s1,
+               zeek::IntrusivePtr<Stmt> arg_s2)
 	: ExprStmt(STMT_IF, std::move(test)),
 	  s1(std::move(arg_s1)), s2(std::move(arg_s2))
 	{
@@ -380,7 +381,7 @@ IfStmt::IfStmt(IntrusivePtr<Expr> test,
 
 IfStmt::~IfStmt() = default;
 
-IntrusivePtr<Val> IfStmt::DoExec(Frame* f, Val* v, stmt_flow_type& flow) const
+zeek::IntrusivePtr<Val> IfStmt::DoExec(Frame* f, Val* v, stmt_flow_type& flow) const
 	{
 	// Treat 0 as false, but don't require 1 for true.
 	Stmt* do_stmt = v->IsZero() ? s2.get() : s1.get();
@@ -465,8 +466,8 @@ static BroStmtTag get_last_stmt_tag(const Stmt* stmt)
 	return get_last_stmt_tag(stmts->Stmts()[len - 1]);
 	}
 
-Case::Case(IntrusivePtr<ListExpr> arg_expr_cases, id_list* arg_type_cases,
-           IntrusivePtr<Stmt> arg_s)
+Case::Case(zeek::IntrusivePtr<ListExpr> arg_expr_cases, id_list* arg_type_cases,
+           zeek::IntrusivePtr<Stmt> arg_s)
 	: expr_cases(std::move(arg_expr_cases)), type_cases(arg_type_cases),
 	  s(std::move(arg_s))
 	{
@@ -583,14 +584,14 @@ static void int_del_func(void* v)
 
 void SwitchStmt::Init()
 	{
-	auto t = make_intrusive<TypeList>();
+	auto t = zeek::make_intrusive<TypeList>();
 	t->Append(e->GetType());
 	comp_hash = new CompositeHash(std::move(t));
 
 	case_label_value_map.SetDeleteFunc(int_del_func);
 	}
 
-SwitchStmt::SwitchStmt(IntrusivePtr<Expr> index, case_list* arg_cases)
+SwitchStmt::SwitchStmt(zeek::IntrusivePtr<Expr> index, case_list* arg_cases)
 	: ExprStmt(STMT_SWITCH, std::move(index)),
 	  cases(arg_cases), default_case_idx(-1)
 	{
@@ -796,9 +797,9 @@ std::pair<int, ID*> SwitchStmt::FindCaseLabelMatch(const Val* v) const
 		return std::make_pair(label_idx, label_id);
 	}
 
-IntrusivePtr<Val> SwitchStmt::DoExec(Frame* f, Val* v, stmt_flow_type& flow) const
+zeek::IntrusivePtr<Val> SwitchStmt::DoExec(Frame* f, Val* v, stmt_flow_type& flow) const
 	{
-	IntrusivePtr<Val> rval;
+	zeek::IntrusivePtr<Val> rval;
 
 	auto m = FindCaseLabelMatch(v);
 	int matching_label_idx = m.first;
@@ -881,7 +882,7 @@ TraversalCode SwitchStmt::Traverse(TraversalCallback* cb) const
 	HANDLE_TC_STMT_POST(tc);
 	}
 
-AddStmt::AddStmt(IntrusivePtr<Expr> arg_e) : ExprStmt(STMT_ADD, std::move(arg_e))
+AddStmt::AddStmt(zeek::IntrusivePtr<Expr> arg_e) : ExprStmt(STMT_ADD, std::move(arg_e))
 	{
 	if ( ! e->CanAdd() )
 		Error("illegal add statement");
@@ -892,7 +893,7 @@ bool AddStmt::IsPure() const
 	return false;
 	}
 
-IntrusivePtr<Val> AddStmt::Exec(Frame* f, stmt_flow_type& flow) const
+zeek::IntrusivePtr<Val> AddStmt::Exec(Frame* f, stmt_flow_type& flow) const
 	{
 	RegisterAccess();
 	flow = FLOW_NEXT;
@@ -914,7 +915,7 @@ TraversalCode AddStmt::Traverse(TraversalCallback* cb) const
 	HANDLE_TC_STMT_POST(tc);
 	}
 
-DelStmt::DelStmt(IntrusivePtr<Expr> arg_e) : ExprStmt(STMT_DELETE, std::move(arg_e))
+DelStmt::DelStmt(zeek::IntrusivePtr<Expr> arg_e) : ExprStmt(STMT_DELETE, std::move(arg_e))
 	{
 	if ( e->IsError() )
 		return;
@@ -928,7 +929,7 @@ bool DelStmt::IsPure() const
 	return false;
 	}
 
-IntrusivePtr<Val> DelStmt::Exec(Frame* f, stmt_flow_type& flow) const
+zeek::IntrusivePtr<Val> DelStmt::Exec(Frame* f, stmt_flow_type& flow) const
 	{
 	RegisterAccess();
 	flow = FLOW_NEXT;
@@ -949,12 +950,12 @@ TraversalCode DelStmt::Traverse(TraversalCallback* cb) const
 	HANDLE_TC_STMT_POST(tc);
 	}
 
-EventStmt::EventStmt(IntrusivePtr<EventExpr> arg_e)
+EventStmt::EventStmt(zeek::IntrusivePtr<EventExpr> arg_e)
 	: ExprStmt(STMT_EVENT, arg_e), event_expr(std::move(arg_e))
 	{
 	}
 
-IntrusivePtr<Val> EventStmt::Exec(Frame* f, stmt_flow_type& flow) const
+zeek::IntrusivePtr<Val> EventStmt::Exec(Frame* f, stmt_flow_type& flow) const
 	{
 	RegisterAccess();
 	auto args = eval_list(f, event_expr->Args());
@@ -980,8 +981,8 @@ TraversalCode EventStmt::Traverse(TraversalCallback* cb) const
 	HANDLE_TC_STMT_POST(tc);
 	}
 
-WhileStmt::WhileStmt(IntrusivePtr<Expr> arg_loop_condition,
-                     IntrusivePtr<Stmt> arg_body)
+WhileStmt::WhileStmt(zeek::IntrusivePtr<Expr> arg_loop_condition,
+                     zeek::IntrusivePtr<Stmt> arg_body)
 	: loop_condition(std::move(arg_loop_condition)), body(std::move(arg_body))
 	{
 	if ( ! loop_condition->IsError() &&
@@ -1030,11 +1031,11 @@ TraversalCode WhileStmt::Traverse(TraversalCallback* cb) const
 	HANDLE_TC_STMT_POST(tc);
 	}
 
-IntrusivePtr<Val> WhileStmt::Exec(Frame* f, stmt_flow_type& flow) const
+zeek::IntrusivePtr<Val> WhileStmt::Exec(Frame* f, stmt_flow_type& flow) const
 	{
 	RegisterAccess();
 	flow = FLOW_NEXT;
-	IntrusivePtr<Val> rval;
+	zeek::IntrusivePtr<Val> rval;
 
 	for ( ; ; )
 		{
@@ -1059,7 +1060,7 @@ IntrusivePtr<Val> WhileStmt::Exec(Frame* f, stmt_flow_type& flow) const
 	return rval;
 	}
 
-ForStmt::ForStmt(id_list* arg_loop_vars, IntrusivePtr<Expr> loop_expr)
+ForStmt::ForStmt(id_list* arg_loop_vars, zeek::IntrusivePtr<Expr> loop_expr)
 	: ExprStmt(STMT_FOR, std::move(loop_expr))
 	{
 	loop_vars = arg_loop_vars;
@@ -1089,7 +1090,7 @@ ForStmt::ForStmt(id_list* arg_loop_vars, IntrusivePtr<Expr> loop_expr)
 
 			else
 				{
-				add_local({NewRef{}, lv}, ind_type, INIT_NONE,
+				add_local({zeek::NewRef{}, lv}, ind_type, INIT_NONE,
 				          nullptr, nullptr, VAR_REGULAR);
 				}
 			}
@@ -1106,7 +1107,7 @@ ForStmt::ForStmt(id_list* arg_loop_vars, IntrusivePtr<Expr> loop_expr)
 		const auto& t = (*loop_vars)[0]->GetType();
 
 		if ( ! t )
-			add_local({NewRef{}, (*loop_vars)[0]}, base_type(TYPE_COUNT),
+			add_local({zeek::NewRef{}, (*loop_vars)[0]}, base_type(TYPE_COUNT),
 						INIT_NONE, nullptr, nullptr, VAR_REGULAR);
 
 		else if ( ! IsIntegral(t->Tag()) )
@@ -1127,7 +1128,7 @@ ForStmt::ForStmt(id_list* arg_loop_vars, IntrusivePtr<Expr> loop_expr)
 		const auto& t = (*loop_vars)[0]->GetType();
 
 		if ( ! t )
-			add_local({NewRef{}, (*loop_vars)[0]},
+			add_local({zeek::NewRef{}, (*loop_vars)[0]},
 					base_type(TYPE_STRING),
 					INIT_NONE, nullptr, nullptr, VAR_REGULAR);
 
@@ -1142,7 +1143,7 @@ ForStmt::ForStmt(id_list* arg_loop_vars, IntrusivePtr<Expr> loop_expr)
 	}
 
 ForStmt::ForStmt(id_list* arg_loop_vars,
-                 IntrusivePtr<Expr> loop_expr, IntrusivePtr<ID> val_var)
+                 zeek::IntrusivePtr<Expr> loop_expr, zeek::IntrusivePtr<ID> val_var)
 	: ForStmt(arg_loop_vars, std::move(loop_expr))
 	{
 	value_var = std::move(val_var);
@@ -1173,9 +1174,9 @@ ForStmt::~ForStmt()
 	delete loop_vars;
 	}
 
-IntrusivePtr<Val> ForStmt::DoExec(Frame* f, Val* v, stmt_flow_type& flow) const
+zeek::IntrusivePtr<Val> ForStmt::DoExec(Frame* f, Val* v, stmt_flow_type& flow) const
 	{
-	IntrusivePtr<Val> ret;
+	zeek::IntrusivePtr<Val> ret;
 
 	if ( v->GetType()->Tag() == TYPE_TABLE )
 		{
@@ -1247,7 +1248,7 @@ IntrusivePtr<Val> ForStmt::DoExec(Frame* f, Val* v, stmt_flow_type& flow) const
 
 		for ( int i = 0; i < sval->Len(); ++i )
 			{
-			auto sv = make_intrusive<StringVal>(1, (const char*) sval->Bytes() + i);
+			auto sv = zeek::make_intrusive<StringVal>(1, (const char*) sval->Bytes() + i);
 			f->SetElement((*loop_vars)[0], std::move(sv));
 			flow = FLOW_NEXT;
 			ret = body->Exec(f, flow);
@@ -1331,7 +1332,7 @@ TraversalCode ForStmt::Traverse(TraversalCallback* cb) const
 	HANDLE_TC_STMT_POST(tc);
 	}
 
-IntrusivePtr<Val> NextStmt::Exec(Frame* /* f */, stmt_flow_type& flow) const
+zeek::IntrusivePtr<Val> NextStmt::Exec(Frame* /* f */, stmt_flow_type& flow) const
 	{
 	RegisterAccess();
 	flow = FLOW_LOOP;
@@ -1358,7 +1359,7 @@ TraversalCode NextStmt::Traverse(TraversalCallback* cb) const
 	HANDLE_TC_STMT_POST(tc);
 	}
 
-IntrusivePtr<Val> BreakStmt::Exec(Frame* /* f */, stmt_flow_type& flow) const
+zeek::IntrusivePtr<Val> BreakStmt::Exec(Frame* /* f */, stmt_flow_type& flow) const
 	{
 	RegisterAccess();
 	flow = FLOW_BREAK;
@@ -1385,7 +1386,7 @@ TraversalCode BreakStmt::Traverse(TraversalCallback* cb) const
 	HANDLE_TC_STMT_POST(tc);
 	}
 
-IntrusivePtr<Val> FallthroughStmt::Exec(Frame* /* f */, stmt_flow_type& flow) const
+zeek::IntrusivePtr<Val> FallthroughStmt::Exec(Frame* /* f */, stmt_flow_type& flow) const
 	{
 	RegisterAccess();
 	flow = FLOW_FALLTHROUGH;
@@ -1412,7 +1413,7 @@ TraversalCode FallthroughStmt::Traverse(TraversalCallback* cb) const
 	HANDLE_TC_STMT_POST(tc);
 	}
 
-ReturnStmt::ReturnStmt(IntrusivePtr<Expr> arg_e)
+ReturnStmt::ReturnStmt(zeek::IntrusivePtr<Expr> arg_e)
 	: ExprStmt(STMT_RETURN, std::move(arg_e))
 	{
 	Scope* s = current_scope();
@@ -1456,7 +1457,7 @@ ReturnStmt::ReturnStmt(IntrusivePtr<Expr> arg_e)
 		}
 	}
 
-IntrusivePtr<Val> ReturnStmt::Exec(Frame* f, stmt_flow_type& flow) const
+zeek::IntrusivePtr<Val> ReturnStmt::Exec(Frame* f, stmt_flow_type& flow) const
 	{
 	RegisterAccess();
 	flow = FLOW_RETURN;
@@ -1495,7 +1496,7 @@ StmtList::~StmtList()
 		Unref(stmt);
 	}
 
-IntrusivePtr<Val> StmtList::Exec(Frame* f, stmt_flow_type& flow) const
+zeek::IntrusivePtr<Val> StmtList::Exec(Frame* f, stmt_flow_type& flow) const
 	{
 	RegisterAccess();
 	flow = FLOW_NEXT;
@@ -1574,7 +1575,7 @@ TraversalCode StmtList::Traverse(TraversalCallback* cb) const
 	HANDLE_TC_STMT_POST(tc);
 	}
 
-IntrusivePtr<Val> EventBodyList::Exec(Frame* f, stmt_flow_type& flow) const
+zeek::IntrusivePtr<Val> EventBodyList::Exec(Frame* f, stmt_flow_type& flow) const
 	{
 	RegisterAccess();
 	flow = FLOW_NEXT;
@@ -1632,7 +1633,7 @@ void EventBodyList::Describe(ODesc* d) const
 		StmtList::Describe(d);
 	}
 
-InitStmt::InitStmt(std::vector<IntrusivePtr<ID>> arg_inits) : Stmt(STMT_INIT)
+InitStmt::InitStmt(std::vector<zeek::IntrusivePtr<ID>> arg_inits) : Stmt(STMT_INIT)
 	{
 	inits = std::move(arg_inits);
 
@@ -1640,7 +1641,7 @@ InitStmt::InitStmt(std::vector<IntrusivePtr<ID>> arg_inits) : Stmt(STMT_INIT)
 		SetLocationInfo(inits[0]->GetLocationInfo());
 	}
 
-IntrusivePtr<Val> InitStmt::Exec(Frame* f, stmt_flow_type& flow) const
+zeek::IntrusivePtr<Val> InitStmt::Exec(Frame* f, stmt_flow_type& flow) const
 	{
 	RegisterAccess();
 	flow = FLOW_NEXT;
@@ -1649,18 +1650,18 @@ IntrusivePtr<Val> InitStmt::Exec(Frame* f, stmt_flow_type& flow) const
 		{
 		const auto& t = aggr->GetType();
 
-		IntrusivePtr<Val> v;
+		zeek::IntrusivePtr<Val> v;
 
 		switch ( t->Tag() ) {
 		case TYPE_RECORD:
-			v = make_intrusive<RecordVal>(cast_intrusive<RecordType>(t));
+			v = zeek::make_intrusive<RecordVal>(zeek::cast_intrusive<RecordType>(t));
 			break;
 		case TYPE_VECTOR:
-			v = make_intrusive<VectorVal>(cast_intrusive<VectorType>(t));
+			v = zeek::make_intrusive<VectorVal>(zeek::cast_intrusive<VectorType>(t));
 			break;
 		case TYPE_TABLE:
-			v = make_intrusive<TableVal>(cast_intrusive<TableType>(t),
-			                             aggr->GetAttrs());
+			v = zeek::make_intrusive<TableVal>(zeek::cast_intrusive<TableType>(t),
+			                                   aggr->GetAttrs());
 			break;
 		default:
 			break;
@@ -1705,7 +1706,7 @@ TraversalCode InitStmt::Traverse(TraversalCallback* cb) const
 	HANDLE_TC_STMT_POST(tc);
 	}
 
-IntrusivePtr<Val> NullStmt::Exec(Frame* /* f */, stmt_flow_type& flow) const
+zeek::IntrusivePtr<Val> NullStmt::Exec(Frame* /* f */, stmt_flow_type& flow) const
 	{
 	RegisterAccess();
 	flow = FLOW_NEXT;
@@ -1734,9 +1735,9 @@ TraversalCode NullStmt::Traverse(TraversalCallback* cb) const
 	HANDLE_TC_STMT_POST(tc);
 	}
 
-WhenStmt::WhenStmt(IntrusivePtr<Expr> arg_cond,
-                   IntrusivePtr<Stmt> arg_s1, IntrusivePtr<Stmt> arg_s2,
-                   IntrusivePtr<Expr> arg_timeout, bool arg_is_return)
+WhenStmt::WhenStmt(zeek::IntrusivePtr<Expr> arg_cond,
+                   zeek::IntrusivePtr<Stmt> arg_s1, zeek::IntrusivePtr<Stmt> arg_s2,
+                   zeek::IntrusivePtr<Expr> arg_timeout, bool arg_is_return)
 	: Stmt(STMT_WHEN),
 	  cond(std::move(arg_cond)), s1(std::move(arg_s1)), s2(std::move(arg_s2)),
 	  timeout(std::move(arg_timeout)), is_return(arg_is_return)
@@ -1760,7 +1761,7 @@ WhenStmt::WhenStmt(IntrusivePtr<Expr> arg_cond,
 
 WhenStmt::~WhenStmt() = default;
 
-IntrusivePtr<Val> WhenStmt::Exec(Frame* f, stmt_flow_type& flow) const
+zeek::IntrusivePtr<Val> WhenStmt::Exec(Frame* f, stmt_flow_type& flow) const
 	{
 	RegisterAccess();
 	flow = FLOW_NEXT;
diff --git a/src/Stmt.h b/src/Stmt.h
index b39872aee8..342674980b 100644
--- a/src/Stmt.h
+++ b/src/Stmt.h
@@ -29,7 +29,7 @@ public:
 
 	~Stmt() override;
 
-	virtual IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const = 0;
+	virtual zeek::IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const = 0;
 
 	Stmt* Ref()			{ ::Ref(this); return this; }
 
@@ -93,17 +93,17 @@ public:
 	TraversalCode Traverse(TraversalCallback* cb) const override;
 
 protected:
-	ExprListStmt(BroStmtTag t, IntrusivePtr<ListExpr> arg_l);
+	ExprListStmt(BroStmtTag t, zeek::IntrusivePtr<ListExpr> arg_l);
 
 	~ExprListStmt() override;
 
-	IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
-	virtual IntrusivePtr<Val> DoExec(std::vector<IntrusivePtr<Val>> vals,
-	                                 stmt_flow_type& flow) const = 0;
+	zeek::IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
+	virtual zeek::IntrusivePtr<Val> DoExec(std::vector<zeek::IntrusivePtr<Val>> vals,
+	                                       stmt_flow_type& flow) const = 0;
 
 	void Describe(ODesc* d) const override;
 
-	IntrusivePtr<ListExpr> l;
+	zeek::IntrusivePtr<ListExpr> l;
 };
 
 class PrintStmt final : public ExprListStmt {
@@ -112,16 +112,16 @@ public:
 	explicit PrintStmt(L&& l) : ExprListStmt(STMT_PRINT, std::forward<L>(l)) { }
 
 protected:
-	IntrusivePtr<Val> DoExec(std::vector<IntrusivePtr<Val>> vals,
-	                         stmt_flow_type& flow) const override;
+	zeek::IntrusivePtr<Val> DoExec(std::vector<zeek::IntrusivePtr<Val>> vals,
+	                               stmt_flow_type& flow) const override;
 };
 
 class ExprStmt : public Stmt {
 public:
-	explicit ExprStmt(IntrusivePtr<Expr> e);
+	explicit ExprStmt(zeek::IntrusivePtr<Expr> e);
 	~ExprStmt() override;
 
-	IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
+	zeek::IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
 
 	const Expr* StmtExpr() const	{ return e.get(); }
 
@@ -130,18 +130,18 @@ public:
 	TraversalCode Traverse(TraversalCallback* cb) const override;
 
 protected:
-	ExprStmt(BroStmtTag t, IntrusivePtr<Expr> e);
+	ExprStmt(BroStmtTag t, zeek::IntrusivePtr<Expr> e);
 
-	virtual IntrusivePtr<Val> DoExec(Frame* f, Val* v, stmt_flow_type& flow) const;
+	virtual zeek::IntrusivePtr<Val> DoExec(Frame* f, Val* v, stmt_flow_type& flow) const;
 
 	bool IsPure() const override;
 
-	IntrusivePtr<Expr> e;
+	zeek::IntrusivePtr<Expr> e;
 };
 
 class IfStmt final : public ExprStmt {
 public:
-	IfStmt(IntrusivePtr<Expr> test, IntrusivePtr<Stmt> s1, IntrusivePtr<Stmt> s2);
+	IfStmt(zeek::IntrusivePtr<Expr> test, zeek::IntrusivePtr<Stmt> s1, zeek::IntrusivePtr<Stmt> s2);
 	~IfStmt() override;
 
 	const Stmt* TrueBranch() const	{ return s1.get(); }
@@ -152,16 +152,16 @@ public:
 	TraversalCode Traverse(TraversalCallback* cb) const override;
 
 protected:
-	IntrusivePtr<Val> DoExec(Frame* f, Val* v, stmt_flow_type& flow) const override;
+	zeek::IntrusivePtr<Val> DoExec(Frame* f, Val* v, stmt_flow_type& flow) const override;
 	bool IsPure() const override;
 
-	IntrusivePtr<Stmt> s1;
-	IntrusivePtr<Stmt> s2;
+	zeek::IntrusivePtr<Stmt> s1;
+	zeek::IntrusivePtr<Stmt> s2;
 };
 
 class Case final : public BroObj {
 public:
-	Case(IntrusivePtr<ListExpr> c, id_list* types, IntrusivePtr<Stmt> arg_s);
+	Case(zeek::IntrusivePtr<ListExpr> c, id_list* types, zeek::IntrusivePtr<Stmt> arg_s);
 	~Case() override;
 
 	const ListExpr* ExprCases() const	{ return expr_cases.get(); }
@@ -178,16 +178,16 @@ public:
 	TraversalCode Traverse(TraversalCallback* cb) const;
 
 protected:
-	IntrusivePtr<ListExpr> expr_cases;
+	zeek::IntrusivePtr<ListExpr> expr_cases;
 	id_list* type_cases;
-	IntrusivePtr<Stmt> s;
+	zeek::IntrusivePtr<Stmt> s;
 };
 
 using case_list = PList<Case>;
 
 class SwitchStmt final : public ExprStmt {
 public:
-	SwitchStmt(IntrusivePtr<Expr> index, case_list* cases);
+	SwitchStmt(zeek::IntrusivePtr<Expr> index, case_list* cases);
 	~SwitchStmt() override;
 
 	const case_list* Cases() const	{ return cases; }
@@ -197,7 +197,7 @@ public:
 	TraversalCode Traverse(TraversalCallback* cb) const override;
 
 protected:
-	IntrusivePtr<Val> DoExec(Frame* f, Val* v, stmt_flow_type& flow) const override;
+	zeek::IntrusivePtr<Val> DoExec(Frame* f, Val* v, stmt_flow_type& flow) const override;
 	bool IsPure() const override;
 
 	// Initialize composite hash and case label map.
@@ -228,40 +228,40 @@ protected:
 
 class AddStmt final : public ExprStmt {
 public:
-	explicit AddStmt(IntrusivePtr<Expr> e);
+	explicit AddStmt(zeek::IntrusivePtr<Expr> e);
 
 	bool IsPure() const override;
-	IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
+	zeek::IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
 
 	TraversalCode Traverse(TraversalCallback* cb) const override;
 };
 
 class DelStmt final : public ExprStmt {
 public:
-	explicit DelStmt(IntrusivePtr<Expr> e);
+	explicit DelStmt(zeek::IntrusivePtr<Expr> e);
 
 	bool IsPure() const override;
-	IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
+	zeek::IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
 
 	TraversalCode Traverse(TraversalCallback* cb) const override;
 };
 
 class EventStmt final : public ExprStmt {
 public:
-	explicit EventStmt(IntrusivePtr<EventExpr> e);
+	explicit EventStmt(zeek::IntrusivePtr<EventExpr> e);
 
-	IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
+	zeek::IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
 
 	TraversalCode Traverse(TraversalCallback* cb) const override;
 
 protected:
-	IntrusivePtr<EventExpr> event_expr;
+	zeek::IntrusivePtr<EventExpr> event_expr;
 };
 
 class WhileStmt final : public Stmt {
 public:
 
-	WhileStmt(IntrusivePtr<Expr> loop_condition, IntrusivePtr<Stmt> body);
+	WhileStmt(zeek::IntrusivePtr<Expr> loop_condition, zeek::IntrusivePtr<Stmt> body);
 	~WhileStmt() override;
 
 	bool IsPure() const override;
@@ -271,20 +271,20 @@ public:
 	TraversalCode Traverse(TraversalCallback* cb) const override;
 
 protected:
-	IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
+	zeek::IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
 
-	IntrusivePtr<Expr> loop_condition;
-	IntrusivePtr<Stmt> body;
+	zeek::IntrusivePtr<Expr> loop_condition;
+	zeek::IntrusivePtr<Stmt> body;
 };
 
 class ForStmt final : public ExprStmt {
 public:
-	ForStmt(id_list* loop_vars, IntrusivePtr<Expr> loop_expr);
+	ForStmt(id_list* loop_vars, zeek::IntrusivePtr<Expr> loop_expr);
 	// Special constructor for key value for loop.
-	ForStmt(id_list* loop_vars, IntrusivePtr<Expr> loop_expr, IntrusivePtr<ID> val_var);
+	ForStmt(id_list* loop_vars, zeek::IntrusivePtr<Expr> loop_expr, zeek::IntrusivePtr<ID> val_var);
 	~ForStmt() override;
 
-	void AddBody(IntrusivePtr<Stmt> arg_body)	{ body = std::move(arg_body); }
+	void AddBody(zeek::IntrusivePtr<Stmt> arg_body)	{ body = std::move(arg_body); }
 
 	const id_list* LoopVar() const	{ return loop_vars; }
 	const Expr* LoopExpr() const	{ return e.get(); }
@@ -297,20 +297,20 @@ public:
 	TraversalCode Traverse(TraversalCallback* cb) const override;
 
 protected:
-	IntrusivePtr<Val> DoExec(Frame* f, Val* v, stmt_flow_type& flow) const override;
+	zeek::IntrusivePtr<Val> DoExec(Frame* f, Val* v, stmt_flow_type& flow) const override;
 
 	id_list* loop_vars;
-	IntrusivePtr<Stmt> body;
+	zeek::IntrusivePtr<Stmt> body;
 	// Stores the value variable being used for a key value for loop.
 	// Always set to nullptr unless special constructor is called.
-	IntrusivePtr<ID> value_var;
+	zeek::IntrusivePtr<ID> value_var;
 };
 
 class NextStmt final : public Stmt {
 public:
 	NextStmt() : Stmt(STMT_NEXT)	{ }
 
-	IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
+	zeek::IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
 	bool IsPure() const override;
 
 	void Describe(ODesc* d) const override;
@@ -324,7 +324,7 @@ class BreakStmt final : public Stmt {
 public:
 	BreakStmt() : Stmt(STMT_BREAK)	{ }
 
-	IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
+	zeek::IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
 	bool IsPure() const override;
 
 	void Describe(ODesc* d) const override;
@@ -338,7 +338,7 @@ class FallthroughStmt final : public Stmt {
 public:
 	FallthroughStmt() : Stmt(STMT_FALLTHROUGH)	{ }
 
-	IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
+	zeek::IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
 	bool IsPure() const override;
 
 	void Describe(ODesc* d) const override;
@@ -350,9 +350,9 @@ protected:
 
 class ReturnStmt final : public ExprStmt {
 public:
-	explicit ReturnStmt(IntrusivePtr<Expr> e);
+	explicit ReturnStmt(zeek::IntrusivePtr<Expr> e);
 
-	IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
+	zeek::IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
 
 	void Describe(ODesc* d) const override;
 };
@@ -362,7 +362,7 @@ public:
 	StmtList();
 	~StmtList() override;
 
-	IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
+	zeek::IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
 
 	const stmt_list& Stmts() const	{ return stmts; }
 	stmt_list& Stmts()		{ return stmts; }
@@ -382,7 +382,7 @@ public:
 	EventBodyList() : StmtList()
 		{ topmost = false; tag = STMT_EVENT_BODY_LIST; }
 
-	IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
+	zeek::IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
 
 	void Describe(ODesc* d) const override;
 
@@ -396,11 +396,11 @@ protected:
 
 class InitStmt final : public Stmt {
 public:
-	explicit InitStmt(std::vector<IntrusivePtr<ID>> arg_inits);
+	explicit InitStmt(std::vector<zeek::IntrusivePtr<ID>> arg_inits);
 
-	IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
+	zeek::IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
 
-	const std::vector<IntrusivePtr<ID>>& Inits() const
+	const std::vector<zeek::IntrusivePtr<ID>>& Inits() const
 		{ return inits; }
 
 	void Describe(ODesc* d) const override;
@@ -408,14 +408,14 @@ public:
 	TraversalCode Traverse(TraversalCallback* cb) const override;
 
 protected:
-	std::vector<IntrusivePtr<ID>> inits;
+	std::vector<zeek::IntrusivePtr<ID>> inits;
 };
 
 class NullStmt final : public Stmt {
 public:
 	NullStmt() : Stmt(STMT_NULL)	{ }
 
-	IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
+	zeek::IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
 	bool IsPure() const override;
 
 	void Describe(ODesc* d) const override;
@@ -426,12 +426,12 @@ public:
 class WhenStmt final : public Stmt {
 public:
 	// s2 is null if no timeout block given.
-	WhenStmt(IntrusivePtr<Expr> cond,
-	         IntrusivePtr<Stmt> s1, IntrusivePtr<Stmt> s2,
-	         IntrusivePtr<Expr> timeout, bool is_return);
+	WhenStmt(zeek::IntrusivePtr<Expr> cond,
+	         zeek::IntrusivePtr<Stmt> s1, zeek::IntrusivePtr<Stmt> s2,
+	         zeek::IntrusivePtr<Expr> timeout, bool is_return);
 	~WhenStmt() override;
 
-	IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
+	zeek::IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
 	bool IsPure() const override;
 
 	const Expr* Cond() const	{ return cond.get(); }
@@ -444,10 +444,10 @@ public:
 	TraversalCode Traverse(TraversalCallback* cb) const override;
 
 protected:
-	IntrusivePtr<Expr> cond;
-	IntrusivePtr<Stmt> s1;
-	IntrusivePtr<Stmt> s2;
-	IntrusivePtr<Expr> timeout;
+	zeek::IntrusivePtr<Expr> cond;
+	zeek::IntrusivePtr<Stmt> s1;
+	zeek::IntrusivePtr<Stmt> s2;
+	zeek::IntrusivePtr<Expr> timeout;
 	bool is_return;
 };
 
diff --git a/src/Tag.cc b/src/Tag.cc
index cd2a93b7fb..604bca933f 100644
--- a/src/Tag.cc
+++ b/src/Tag.cc
@@ -4,7 +4,7 @@
 #include "Val.h"
 #include "IntrusivePtr.h"
 
-Tag::Tag(const IntrusivePtr<zeek::EnumType>& etype, type_t arg_type, subtype_t arg_subtype)
+Tag::Tag(const zeek::IntrusivePtr<zeek::EnumType>& etype, type_t arg_type, subtype_t arg_subtype)
 	{
 	assert(arg_type > 0);
 
@@ -15,10 +15,10 @@ Tag::Tag(const IntrusivePtr<zeek::EnumType>& etype, type_t arg_type, subtype_t a
 	}
 
 Tag::Tag(zeek::EnumType* etype, type_t arg_type, subtype_t arg_subtype)
-	: Tag({NewRef{}, etype}, arg_type, arg_subtype)
+	: Tag({zeek::NewRef{}, etype}, arg_type, arg_subtype)
 	{ }
 
-Tag::Tag(IntrusivePtr<EnumVal> arg_val)
+Tag::Tag(zeek::IntrusivePtr<EnumVal> arg_val)
 	{
 	assert(arg_val);
 
@@ -30,7 +30,7 @@ Tag::Tag(IntrusivePtr<EnumVal> arg_val)
 	}
 
 Tag::Tag(EnumVal* arg_val)
-	: Tag({NewRef{}, arg_val})
+	: Tag({zeek::NewRef{}, arg_val})
 	{ }
 
 Tag::Tag(const Tag& other)
@@ -73,7 +73,7 @@ Tag& Tag::operator=(const Tag&& other) noexcept
 	return *this;
 	}
 
-const IntrusivePtr<EnumVal>& Tag::AsVal(const IntrusivePtr<zeek::EnumType>& etype) const
+const zeek::IntrusivePtr<EnumVal>& Tag::AsVal(const zeek::IntrusivePtr<zeek::EnumType>& etype) const
 	{
 	if ( ! val )
 		{
@@ -86,7 +86,7 @@ const IntrusivePtr<EnumVal>& Tag::AsVal(const IntrusivePtr<zeek::EnumType>& etyp
 
 EnumVal* Tag::AsEnumVal(zeek::EnumType* etype) const
 	{
-	return AsVal({NewRef{}, etype}).get();
+	return AsVal({zeek::NewRef{}, etype}).get();
 	}
 
 std::string Tag::AsString() const
diff --git a/src/Tag.h b/src/Tag.h
index 763d14ef7a..11c2aa49cc 100644
--- a/src/Tag.h
+++ b/src/Tag.h
@@ -116,7 +116,7 @@ protected:
 	 *
 	 * @param etype the script-layer enum type associated with the tag.
 	 */
-	const IntrusivePtr<EnumVal>& AsVal(const IntrusivePtr<zeek::EnumType>& etype) const;
+	const zeek::IntrusivePtr<EnumVal>& AsVal(const zeek::IntrusivePtr<zeek::EnumType>& etype) const;
 
 	[[deprecated("Remove in v4.1.  Use AsVal() instead.")]]
 	EnumVal* AsEnumVal(zeek::EnumType* etype) const;
@@ -132,9 +132,9 @@ protected:
 	 * @param subtype The sub type, which is left to an analyzer for
 	 * interpretation. By default it's set to zero.
 	 */
-	Tag(const IntrusivePtr<zeek::EnumType>& etype, type_t type, subtype_t subtype = 0);
+	Tag(const zeek::IntrusivePtr<zeek::EnumType>& etype, type_t type, subtype_t subtype = 0);
 
-	[[deprecated("Remove in v4.1.  Construct from IntrusivePtr& instead.")]]
+	[[deprecated("Remove in v4.1.  Construct from zeek::IntrusivePtr& instead.")]]
 	Tag(zeek::EnumType* etype, type_t type, subtype_t subtype = 0);
 
 	/**
@@ -142,13 +142,13 @@ protected:
 	 *
 	 * @param val An enum value of script type \c Analyzer::Tag.
 	 */
-	explicit Tag(IntrusivePtr<EnumVal> val);
+	explicit Tag(zeek::IntrusivePtr<EnumVal> val);
 
-	[[deprecated("Remove in v4.1.  Construct from IntrusivePtr instead.")]]
+	[[deprecated("Remove in v4.1.  Construct from zeek::IntrusivePtr instead.")]]
 	explicit Tag(EnumVal* val);
 
 private:
 	type_t type;            // Main type.
 	subtype_t subtype;      // Subtype.
-	mutable IntrusivePtr<EnumVal> val;   // Script-layer value.
+	mutable zeek::IntrusivePtr<EnumVal> val;   // Script-layer value.
 };
diff --git a/src/Trigger.cc b/src/Trigger.cc
index 084404de85..7f2ed3f802 100644
--- a/src/Trigger.cc
+++ b/src/Trigger.cc
@@ -151,7 +151,7 @@ Trigger::Trigger(zeek::detail::Expr* arg_cond, zeek::detail::Stmt* arg_body,
 		arg_frame->SetDelayed();
 		}
 
-	IntrusivePtr<Val> timeout_val;
+	zeek::IntrusivePtr<Val> timeout_val;
 
 	if ( arg_timeout )
 		{
@@ -262,9 +262,9 @@ bool Trigger::Eval()
 		return false;
 		}
 
-	f->SetTrigger({NewRef{}, this});
+	f->SetTrigger({zeek::NewRef{}, this});
 
-	IntrusivePtr<Val> v;
+	zeek::IntrusivePtr<Val> v;
 
 	try
 		{
@@ -348,8 +348,8 @@ void Trigger::Timeout()
 	if ( timeout_stmts )
 		{
 		stmt_flow_type flow;
-		IntrusivePtr<Frame> f{AdoptRef{}, frame->Clone()};
-		IntrusivePtr<Val> v;
+		zeek::IntrusivePtr<Frame> f{zeek::AdoptRef{}, frame->Clone()};
+		zeek::IntrusivePtr<Val> v;
 
 		try
 			{
diff --git a/src/TunnelEncapsulation.cc b/src/TunnelEncapsulation.cc
index 1b36a3f898..8649308a5a 100644
--- a/src/TunnelEncapsulation.cc
+++ b/src/TunnelEncapsulation.cc
@@ -16,19 +16,19 @@ EncapsulatingConn::EncapsulatingConn(Connection* c, BifEnum::Tunnel::Type t)
 		}
 	}
 
-IntrusivePtr<RecordVal> EncapsulatingConn::ToVal() const
+zeek::IntrusivePtr<RecordVal> EncapsulatingConn::ToVal() const
 	{
-	auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::Tunnel::EncapsulatingConn);
+	auto rv = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::Tunnel::EncapsulatingConn);
 
-	auto id_val = make_intrusive<RecordVal>(zeek::id::conn_id);
-	id_val->Assign(0, make_intrusive<AddrVal>(src_addr));
+	auto id_val = zeek::make_intrusive<RecordVal>(zeek::id::conn_id);
+	id_val->Assign(0, zeek::make_intrusive<AddrVal>(src_addr));
 	id_val->Assign(1, val_mgr->Port(ntohs(src_port), proto));
-	id_val->Assign(2, make_intrusive<AddrVal>(dst_addr));
+	id_val->Assign(2, zeek::make_intrusive<AddrVal>(dst_addr));
 	id_val->Assign(3, val_mgr->Port(ntohs(dst_port), proto));
 	rv->Assign(0, std::move(id_val));
 	rv->Assign(1, zeek::BifType::Enum::Tunnel::Type->GetVal(type));
 
-	rv->Assign(2, make_intrusive<StringVal>(uid.Base62("C").c_str()));
+	rv->Assign(2, zeek::make_intrusive<StringVal>(uid.Base62("C").c_str()));
 
 	return rv;
 	}
diff --git a/src/TunnelEncapsulation.h b/src/TunnelEncapsulation.h
index 048fcdddfd..53b792832c 100644
--- a/src/TunnelEncapsulation.h
+++ b/src/TunnelEncapsulation.h
@@ -81,7 +81,7 @@ public:
 	/**
 	 * Returns record value of type "EncapsulatingConn" representing the tunnel.
 	 */
-	IntrusivePtr<RecordVal> ToVal() const;
+	zeek::IntrusivePtr<RecordVal> ToVal() const;
 
 	[[deprecated("Remove in v4.1.  Use ToVal() instead.")]]
 	RecordVal* GetRecordVal() const
@@ -196,9 +196,9 @@ public:
 	 * Get the value of type "EncapsulatingConnVector" represented by the
 	 * entire encapsulation chain.
 	 */
-	IntrusivePtr<VectorVal> ToVal() const
+	zeek::IntrusivePtr<VectorVal> ToVal() const
 		{
-		auto vv = make_intrusive<VectorVal>(
+		auto vv = zeek::make_intrusive<VectorVal>(
 		    zeek::id::find_type<zeek::VectorType>("EncapsulatingConnVector"));
 
 		if ( conns )
diff --git a/src/Type.cc b/src/Type.cc
index 698d80c64e..1385254446 100644
--- a/src/Type.cc
+++ b/src/Type.cc
@@ -71,7 +71,7 @@ Type::Type(zeek::TypeTag t, bool arg_base_type)
 	{
 	}
 
-IntrusivePtr<Type> Type::ShallowClone()
+zeek::IntrusivePtr<Type> Type::ShallowClone()
 	{
 	switch ( tag ) {
 		case TYPE_VOID:
@@ -89,7 +89,7 @@ IntrusivePtr<Type> Type::ShallowClone()
 		case TYPE_ADDR:
 		case TYPE_SUBNET:
 		case TYPE_ANY:
-			return make_intrusive<Type>(tag, base_type);
+			return zeek::make_intrusive<Type>(tag, base_type);
 
 		default:
 			reporter->InternalError("cloning illegal base Type");
@@ -111,7 +111,7 @@ int Type::MatchesIndex(zeek::detail::ListExpr* const index) const
 	return DOES_NOT_MATCH_INDEX;
 	}
 
-const IntrusivePtr<Type>& Type::Yield() const
+const zeek::IntrusivePtr<Type>& Type::Yield() const
 	{
 	return Type::nil;
 	}
@@ -163,7 +163,7 @@ bool TypeList::AllMatch(const Type* t, bool is_init) const
 	return true;
 	}
 
-void TypeList::Append(IntrusivePtr<Type> t)
+void TypeList::Append(zeek::IntrusivePtr<Type> t)
 	{
 	if ( pure_type && ! same_type(t, pure_type) )
 		reporter->InternalError("pure type-list violation");
@@ -172,7 +172,7 @@ void TypeList::Append(IntrusivePtr<Type> t)
 	types.emplace_back(std::move(t));
 	}
 
-void TypeList::AppendEvenIfNotPure(IntrusivePtr<Type> t)
+void TypeList::AppendEvenIfNotPure(zeek::IntrusivePtr<Type> t)
 	{
 	if ( pure_type && ! same_type(t, pure_type) )
 		pure_type = nullptr;
@@ -317,7 +317,7 @@ bool IndexType::IsSubNetIndex() const
 	return false;
 	}
 
-TableType::TableType(IntrusivePtr<TypeList> ind, IntrusivePtr<Type> yield)
+TableType::TableType(zeek::IntrusivePtr<TypeList> ind, zeek::IntrusivePtr<Type> yield)
 	: IndexType(TYPE_TABLE, std::move(ind), std::move(yield))
 	{
 	if ( ! indices )
@@ -344,9 +344,9 @@ TableType::TableType(IntrusivePtr<TypeList> ind, IntrusivePtr<Type> yield)
 		}
 	}
 
-IntrusivePtr<Type> TableType::ShallowClone()
+zeek::IntrusivePtr<Type> TableType::ShallowClone()
 	{
-	return make_intrusive<TableType>(indices, yield_type);
+	return zeek::make_intrusive<TableType>(indices, yield_type);
 	}
 
 bool TableType::IsUnspecifiedTable() const
@@ -355,7 +355,7 @@ bool TableType::IsUnspecifiedTable() const
 	return indices->GetTypes().empty();
 	}
 
-SetType::SetType(IntrusivePtr<TypeList> ind, IntrusivePtr<zeek::detail::ListExpr> arg_elements)
+SetType::SetType(zeek::IntrusivePtr<TypeList> ind, zeek::IntrusivePtr<zeek::detail::ListExpr> arg_elements)
 	: TableType(std::move(ind), nullptr), elements(std::move(arg_elements))
 	{
 	if ( elements )
@@ -378,8 +378,8 @@ SetType::SetType(IntrusivePtr<TypeList> ind, IntrusivePtr<zeek::detail::ListExpr
 
 			else if ( tl.size() == 1 )
 				{
-				IntrusivePtr<Type> ft{NewRef{}, flatten_type(tl[0].get())};
-				indices = make_intrusive<TypeList>(ft);
+				zeek::IntrusivePtr<Type> ft{zeek::NewRef{}, flatten_type(tl[0].get())};
+				indices = zeek::make_intrusive<TypeList>(ft);
 				indices->Append(std::move(ft));
 				}
 
@@ -396,24 +396,24 @@ SetType::SetType(IntrusivePtr<TypeList> ind, IntrusivePtr<zeek::detail::ListExpr
 					return;
 					}
 
-				indices = make_intrusive<TypeList>(t);
+				indices = zeek::make_intrusive<TypeList>(t);
 				indices->Append(std::move(t));
 				}
 			}
 		}
 	}
 
-IntrusivePtr<Type> SetType::ShallowClone()
+zeek::IntrusivePtr<Type> SetType::ShallowClone()
 	{
-	return make_intrusive<SetType>(indices, elements);
+	return zeek::make_intrusive<SetType>(indices, elements);
 	}
 
 SetType::~SetType() = default;
 
-FuncType::FuncType(IntrusivePtr<RecordType> arg_args,
-                   IntrusivePtr<Type> arg_yield, FunctionFlavor arg_flavor)
+FuncType::FuncType(zeek::IntrusivePtr<RecordType> arg_args,
+                   zeek::IntrusivePtr<Type> arg_yield, FunctionFlavor arg_flavor)
 	: Type(TYPE_FUNC), args(std::move(arg_args)),
-	  arg_types(make_intrusive<TypeList>()), yield(std::move(arg_yield))
+	  arg_types(zeek::make_intrusive<TypeList>()), yield(std::move(arg_yield))
 	{
 	flavor = arg_flavor;
 
@@ -441,9 +441,9 @@ FuncType::FuncType(IntrusivePtr<RecordType> arg_args,
 	prototypes.emplace_back(Prototype{false, args, std::move(offsets)});
 	}
 
-IntrusivePtr<Type> FuncType::ShallowClone()
+zeek::IntrusivePtr<Type> FuncType::ShallowClone()
 	{
-	auto f = make_intrusive<FuncType>();
+	auto f = zeek::make_intrusive<FuncType>();
 	f->args = args;
 	f->arg_types = arg_types;
 	f->yield = yield;
@@ -481,16 +481,16 @@ int FuncType::MatchesIndex(zeek::detail::ListExpr* const index) const
 
 bool FuncType::CheckArgs(const type_list* args, bool is_init) const
 	{
-	std::vector<IntrusivePtr<Type>> as;
+	std::vector<zeek::IntrusivePtr<Type>> as;
 	as.reserve(args->length());
 
 	for ( auto a : *args )
-		as.emplace_back(NewRef{}, a);
+		as.emplace_back(zeek::NewRef{}, a);
 
 	return CheckArgs(as, is_init);
 	}
 
-bool FuncType::CheckArgs(const std::vector<IntrusivePtr<Type>>& args,
+bool FuncType::CheckArgs(const std::vector<zeek::IntrusivePtr<Type>>& args,
                          bool is_init) const
 	{
 	const auto& my_args = arg_types->GetTypes();
@@ -609,8 +609,8 @@ std::optional<FuncType::Prototype> FuncType::FindPrototype(const RecordType& arg
 	return {};
 	}
 
-TypeDecl::TypeDecl(const char* i, IntrusivePtr<Type> t,
-                   IntrusivePtr<zeek::detail::Attributes> arg_attrs)
+TypeDecl::TypeDecl(const char* i, zeek::IntrusivePtr<Type> t,
+                   zeek::IntrusivePtr<zeek::detail::Attributes> arg_attrs)
 	: type(std::move(t)),
 	  attrs(std::move(arg_attrs)),
 	  id(i)
@@ -658,12 +658,12 @@ RecordType::RecordType(type_decl_list* arg_types) : Type(TYPE_RECORD)
 
 // in this case the clone is actually not so shallow, since
 // it gets modified by everyone.
-IntrusivePtr<Type> RecordType::ShallowClone()
+zeek::IntrusivePtr<Type> RecordType::ShallowClone()
 	{
 	auto pass = new type_decl_list();
 	for ( const auto& type : *types )
 		pass->push_back(new TypeDecl(*type));
-	return make_intrusive<RecordType>(pass);
+	return zeek::make_intrusive<RecordType>(pass);
 	}
 
 RecordType::~RecordType()
@@ -682,7 +682,7 @@ bool RecordType::HasField(const char* field) const
 	return FieldOffset(field) >= 0;
 	}
 
-IntrusivePtr<Val> RecordType::FieldDefault(int field) const
+zeek::IntrusivePtr<Val> RecordType::FieldDefault(int field) const
 	{
 	const TypeDecl* td = FieldDecl(field);
 
@@ -794,31 +794,31 @@ static string container_type_name(const Type* ft)
 	return s;
 	}
 
-IntrusivePtr<TableVal> RecordType::GetRecordFieldsVal(const RecordVal* rv) const
+zeek::IntrusivePtr<TableVal> RecordType::GetRecordFieldsVal(const RecordVal* rv) const
 	{
 	static auto record_field = zeek::id::find_type<RecordType>("record_field");
 	static auto record_field_table = zeek::id::find_type<TableType>("record_field_table");
-	auto rval = make_intrusive<TableVal>(record_field_table);
+	auto rval = zeek::make_intrusive<TableVal>(record_field_table);
 
 	for ( int i = 0; i < NumFields(); ++i )
 		{
 		const auto& ft = GetFieldType(i);
 		const TypeDecl* fd = FieldDecl(i);
-		IntrusivePtr<Val> fv;
+		zeek::IntrusivePtr<Val> fv;
 
 		if ( rv )
 			fv = rv->GetField(i);
 
 		bool logged = (fd->attrs && fd->GetAttr(zeek::detail::ATTR_LOG) != nullptr);
 
-		auto nr = make_intrusive<RecordVal>(record_field);
+		auto nr = zeek::make_intrusive<RecordVal>(record_field);
 
 		string s = container_type_name(ft.get());
-		nr->Assign(0, make_intrusive<StringVal>(s));
+		nr->Assign(0, zeek::make_intrusive<StringVal>(s));
 		nr->Assign(1, val_mgr->Bool(logged));
 		nr->Assign(2, std::move(fv));
 		nr->Assign(3, FieldDefault(i));
-		auto field_name = make_intrusive<StringVal>(FieldName(i));
+		auto field_name = zeek::make_intrusive<StringVal>(FieldName(i));
 		rval->Assign(std::move(field_name), std::move(nr));
 		}
 
@@ -845,9 +845,9 @@ const char* RecordType::AddFields(const type_decl_list& others,
 		if ( add_log_attr )
 			{
 			if ( ! td->attrs )
-				td->attrs = make_intrusive<zeek::detail::Attributes>(td->type, true, false);
+				td->attrs = zeek::make_intrusive<zeek::detail::Attributes>(td->type, true, false);
 
-			td->attrs->AddAttr(make_intrusive<zeek::detail::Attr>(zeek::detail::ATTR_LOG));
+			td->attrs->AddAttr(zeek::make_intrusive<zeek::detail::Attr>(zeek::detail::ATTR_LOG));
 			}
 
 		types->push_back(td);
@@ -1028,7 +1028,7 @@ void SubNetType::Describe(ODesc* d) const
 		d->Add(int(Tag()));
 	}
 
-FileType::FileType(IntrusivePtr<Type> yield_type)
+FileType::FileType(zeek::IntrusivePtr<Type> yield_type)
 	: Type(TYPE_FILE), yield(std::move(yield_type))
 	{
 	}
@@ -1083,12 +1083,12 @@ EnumType::EnumType(const EnumType* e)
 	SetName(e->GetName());
 	}
 
-IntrusivePtr<Type> EnumType::ShallowClone()
+zeek::IntrusivePtr<Type> EnumType::ShallowClone()
 	{
 	if ( counter == 0 )
-		return make_intrusive<EnumType>(GetName());
+		return zeek::make_intrusive<EnumType>(GetName());
 
-	return make_intrusive<EnumType>(this);
+	return zeek::make_intrusive<EnumType>(this);
 	}
 
 EnumType::~EnumType() = default;
@@ -1137,11 +1137,11 @@ void EnumType::CheckAndAddName(const string& module_name, const char* name,
 	if ( ! id )
 		{
 		id = install_ID(name, module_name.c_str(), true, is_export);
-		id->SetType({NewRef{}, this});
+		id->SetType({zeek::NewRef{}, this});
 		id->SetEnumConst();
 
 		if ( deprecation )
-			id->MakeDeprecated({NewRef{}, deprecation});
+			id->MakeDeprecated({zeek::NewRef{}, deprecation});
 
 		zeekygen_mgr->Identifier(std::move(id));
 		}
@@ -1164,7 +1164,7 @@ void EnumType::CheckAndAddName(const string& module_name, const char* name,
 	AddNameInternal(module_name, name, val, is_export);
 
 	if ( vals.find(val) == vals.end() )
-		vals[val] = make_intrusive<EnumVal>(IntrusivePtr{NewRef{}, this}, val);
+		vals[val] = zeek::make_intrusive<EnumVal>(zeek::IntrusivePtr{zeek::NewRef{}, this}, val);
 
 	set<Type*> types = Type::GetAliases(GetName());
 	set<Type*>::const_iterator it;
@@ -1213,13 +1213,13 @@ EnumType::enum_name_list EnumType::Names() const
 	return n;
 	}
 
-const IntrusivePtr<EnumVal>& EnumType::GetVal(bro_int_t i)
+const zeek::IntrusivePtr<EnumVal>& EnumType::GetVal(bro_int_t i)
 	{
 	auto it = vals.find(i);
 
 	if ( it == vals.end() )
 		{
-		auto ev = make_intrusive<EnumVal>(IntrusivePtr{NewRef{}, this}, i);
+		auto ev = zeek::make_intrusive<EnumVal>(zeek::IntrusivePtr{zeek::NewRef{}, this}, i);
 		return vals.emplace(i, std::move(ev)).first->second;
 		}
 
@@ -1303,19 +1303,19 @@ void EnumType::DescribeReST(ODesc* d, bool roles_only) const
 		}
 	}
 
-VectorType::VectorType(IntrusivePtr<Type> element_type)
+VectorType::VectorType(zeek::IntrusivePtr<Type> element_type)
 	: Type(TYPE_VECTOR), yield_type(std::move(element_type))
 	{
 	}
 
-IntrusivePtr<Type> VectorType::ShallowClone()
+zeek::IntrusivePtr<Type> VectorType::ShallowClone()
 	{
-	return make_intrusive<VectorType>(yield_type);
+	return zeek::make_intrusive<VectorType>(yield_type);
 	}
 
 VectorType::~VectorType() = default;
 
-const IntrusivePtr<Type>& VectorType::Yield() const
+const zeek::IntrusivePtr<Type>& VectorType::Yield() const
 	{
 	// Work around the fact that we use void internally to mark a vector
 	// as being unspecified. When looking at its yield type, we need to
@@ -1684,8 +1684,8 @@ TypeTag max_type(TypeTag t1, TypeTag t2)
 		}
 	}
 
-IntrusivePtr<Type> merge_types(const IntrusivePtr<Type>& arg_t1,
-                                  const IntrusivePtr<Type>& arg_t2)
+zeek::IntrusivePtr<Type> merge_types(const zeek::IntrusivePtr<Type>& arg_t1,
+                                     const zeek::IntrusivePtr<Type>& arg_t2)
 	{
 	auto t1 = arg_t1.get();
 	auto t2 = arg_t2.get();
@@ -1758,7 +1758,7 @@ IntrusivePtr<Type> merge_types(const IntrusivePtr<Type>& arg_t1,
 
 		const auto& tl1 = it1->GetIndexTypes();
 		const auto& tl2 = it2->GetIndexTypes();
-		IntrusivePtr<TypeList> tl3;
+		zeek::IntrusivePtr<TypeList> tl3;
 
 		if ( tl1.size() != tl2.size() )
 			{
@@ -1766,7 +1766,7 @@ IntrusivePtr<Type> merge_types(const IntrusivePtr<Type>& arg_t1,
 			return nullptr;
 			}
 
-		tl3 = make_intrusive<TypeList>();
+		tl3 = zeek::make_intrusive<TypeList>();
 
 		for ( auto i = 0u; i < tl1.size(); ++i )
 			{
@@ -1779,7 +1779,7 @@ IntrusivePtr<Type> merge_types(const IntrusivePtr<Type>& arg_t1,
 
 		const auto& y1 = t1->Yield();
 		const auto& y2 = t2->Yield();
-		IntrusivePtr<Type> y3;
+		zeek::IntrusivePtr<Type> y3;
 
 		if ( y1 || y2 )
 			{
@@ -1795,9 +1795,9 @@ IntrusivePtr<Type> merge_types(const IntrusivePtr<Type>& arg_t1,
 			}
 
 		if ( t1->IsSet() )
-			return make_intrusive<SetType>(std::move(tl3), nullptr);
+			return zeek::make_intrusive<SetType>(std::move(tl3), nullptr);
 		else
-			return make_intrusive<TableType>(std::move(tl3), std::move(y3));
+			return zeek::make_intrusive<TableType>(std::move(tl3), std::move(y3));
 		}
 
 	case TYPE_FUNC:
@@ -1810,12 +1810,12 @@ IntrusivePtr<Type> merge_types(const IntrusivePtr<Type>& arg_t1,
 
 		const FuncType* ft1 = (const FuncType*) t1;
 		const FuncType* ft2 = (const FuncType*) t1;
-		auto args = cast_intrusive<RecordType>(merge_types(ft1->Params(),
+		auto args = zeek::cast_intrusive<RecordType>(merge_types(ft1->Params(),
 		                                                   ft2->Params()));
 		auto yield = t1->Yield() ?
 			merge_types(t1->Yield(), t2->Yield()) : nullptr;
 
-		return make_intrusive<FuncType>(std::move(args), std::move(yield),
+		return zeek::make_intrusive<FuncType>(std::move(args), std::move(yield),
 		                                ft1->Flavor());
 		}
 
@@ -1845,7 +1845,7 @@ IntrusivePtr<Type> merge_types(const IntrusivePtr<Type>& arg_t1,
 			tdl3->push_back(new TypeDecl(copy_string(td1->id), std::move(tdl3_i)));
 			}
 
-		return make_intrusive<RecordType>(tdl3);
+		return zeek::make_intrusive<RecordType>(tdl3);
 		}
 
 	case TYPE_LIST:
@@ -1888,7 +1888,7 @@ IntrusivePtr<Type> merge_types(const IntrusivePtr<Type>& arg_t1,
 			return nullptr;
 			}
 
-		auto tl3 = make_intrusive<TypeList>();
+		auto tl3 = zeek::make_intrusive<TypeList>();
 
 		for ( auto i = 0u; i < l1.size(); ++i )
 			tl3->Append(merge_types(l1[i], l2[i]));
@@ -1903,7 +1903,7 @@ IntrusivePtr<Type> merge_types(const IntrusivePtr<Type>& arg_t1,
 			return nullptr;
 			}
 
-		return make_intrusive<VectorType>(merge_types(t1->Yield(), t2->Yield()));
+		return zeek::make_intrusive<VectorType>(merge_types(t1->Yield(), t2->Yield()));
 
 	case TYPE_FILE:
 		if ( ! same_type(t1->Yield(), t2->Yield()) )
@@ -1912,7 +1912,7 @@ IntrusivePtr<Type> merge_types(const IntrusivePtr<Type>& arg_t1,
 			return nullptr;
 			}
 
-		return make_intrusive<FileType>(merge_types(t1->Yield(), t2->Yield()));
+		return zeek::make_intrusive<FileType>(merge_types(t1->Yield(), t2->Yield()));
 
 	case TYPE_UNION:
 		reporter->InternalError("union type in merge_types()");
@@ -1924,7 +1924,7 @@ IntrusivePtr<Type> merge_types(const IntrusivePtr<Type>& arg_t1,
 	}
 	}
 
-IntrusivePtr<Type> merge_type_list(zeek::detail::ListExpr* elements)
+zeek::IntrusivePtr<Type> merge_type_list(zeek::detail::ListExpr* elements)
 	{
 	TypeList* tl_type = elements->GetType()->AsTypeList();
 	const auto& tl = tl_type->GetTypes();
@@ -1969,7 +1969,7 @@ static Type* reduce_type(Type* t)
 		return t;
 	}
 
-IntrusivePtr<Type> init_type(zeek::detail::Expr* init)
+zeek::IntrusivePtr<Type> init_type(zeek::detail::Expr* init)
 	{
 	if ( init->Tag() != zeek::detail::EXPR_LIST )
 		{
@@ -2008,7 +2008,7 @@ IntrusivePtr<Type> init_type(zeek::detail::Expr* init)
 	auto t = e0->InitType();
 
 	if ( t )
-		t = {NewRef{}, reduce_type(t.get())};
+		t = {zeek::NewRef{}, reduce_type(t.get())};
 
 	if ( ! t )
 		return nullptr;
@@ -2016,10 +2016,10 @@ IntrusivePtr<Type> init_type(zeek::detail::Expr* init)
 	for ( int i = 1; t && i < el.length(); ++i )
 		{
 		auto el_t = el[i]->InitType();
-		IntrusivePtr<Type> ti;
+		zeek::IntrusivePtr<Type> ti;
 
 		if ( el_t )
-			ti = {NewRef{}, reduce_type(el_t.get())};
+			ti = {zeek::NewRef{}, reduce_type(el_t.get())};
 
 		if ( ! ti )
 			return nullptr;
@@ -2044,12 +2044,12 @@ IntrusivePtr<Type> init_type(zeek::detail::Expr* init)
 	// it one, as that's what's required for creating a set type.
 	if ( t->Tag() != TYPE_LIST )
 		{
-		auto tl = make_intrusive<TypeList>(t);
+		auto tl = zeek::make_intrusive<TypeList>(t);
 		tl->Append(std::move(t));
 		t = std::move(tl);
 		}
 
-	return make_intrusive<SetType>(cast_intrusive<TypeList>(std::move(t)),
+	return zeek::make_intrusive<SetType>(zeek::cast_intrusive<TypeList>(std::move(t)),
 	                               nullptr);
 	}
 
@@ -2068,14 +2068,14 @@ bool is_atomic_type(const Type& t)
 	}
 	}
 
-const IntrusivePtr<Type>& base_type(zeek::TypeTag tag)
+const zeek::IntrusivePtr<Type>& base_type(zeek::TypeTag tag)
 	{
-	static IntrusivePtr<Type> base_types[NUM_TYPES];
+	static zeek::IntrusivePtr<Type> base_types[NUM_TYPES];
 
 	// We could check here that "tag" actually corresponds to a basic type.
 	if ( ! base_types[tag] )
 		{
-		base_types[tag] = make_intrusive<Type>(tag, true);
+		base_types[tag] = zeek::make_intrusive<Type>(tag, true);
 		// Give the base types a pseudo-location for easier identification.
 		Location l(type_name(tag), 0, 0, 0, 0);
 		base_types[tag]->SetLocationInfo(&l);
diff --git a/src/Type.h b/src/Type.h
index da3f254aa3..71260b6458 100644
--- a/src/Type.h
+++ b/src/Type.h
@@ -14,6 +14,7 @@
 #include <list>
 #include <optional>
 
+class Val;
 class EnumVal;
 class TableVal;
 
@@ -127,6 +128,7 @@ constexpr InternalTypeTag to_internal_type_tag(TypeTag tag) noexcept
 	return TYPE_INTERNAL_VOID;
 	}
 
+class Type;
 class TypeList;
 class TableType;
 class SetType;
@@ -144,7 +146,7 @@ constexpr int MATCHES_INDEX_VECTOR = 2;
 
 class Type : public BroObj {
 public:
-	static inline const IntrusivePtr<Type> nil;
+	static inline const zeek::IntrusivePtr<Type> nil;
 
 	explicit Type(zeek::TypeTag tag, bool base_type = false);
 
@@ -156,7 +158,7 @@ public:
 	// Clone operations will mostly be implemented in the derived classes;
 	// in addition cloning will be limited to classes that can be reached by
 	// the script-level.
-	virtual IntrusivePtr<Type> ShallowClone();
+	virtual zeek::IntrusivePtr<Type> ShallowClone();
 
 	TypeTag Tag() const		{ return tag; }
 	InternalTypeTag InternalType() const	{ return internal_tag; }
@@ -176,7 +178,7 @@ public:
 	// Returns the type yielded by this type.  For example, if
 	// this type is a table[string] of port, then returns the "port"
 	// type.  Returns nil if this is not an index type.
-	virtual const IntrusivePtr<Type>& Yield() const;
+	virtual const zeek::IntrusivePtr<Type>& Yield() const;
 
 	[[deprecated("Remove in v4.1.  Use Yield() instead.")]]
 	virtual Type* YieldType()
@@ -360,7 +362,7 @@ private:
 
 class TypeList final : public Type {
 public:
-	explicit TypeList(IntrusivePtr<Type> arg_pure_type = nullptr)
+	explicit TypeList(zeek::IntrusivePtr<Type> arg_pure_type = nullptr)
 		: Type(TYPE_LIST), pure_type(std::move(arg_pure_type))
 		{
 		}
@@ -371,14 +373,14 @@ public:
 	const type_list* Types() const
 		{ return &types_list; }
 
-	const std::vector<IntrusivePtr<Type>>& GetTypes() const
+	const std::vector<zeek::IntrusivePtr<Type>>& GetTypes() const
 		{ return types; }
 
 	bool IsPure() const		{ return pure_type != nullptr; }
 
 	// Returns the underlying pure type, or nil if the list
 	// is not pure or is empty.
-	const IntrusivePtr<Type>& GetPureType() const
+	const zeek::IntrusivePtr<Type>& GetPureType() const
 		{ return pure_type; }
 
 	[[deprecated("Remove in v4.1.  Use GetPureType() instead.")]]
@@ -390,19 +392,19 @@ public:
 	// is_init is true, then the matching is done in the context
 	// of an initialization.
 	bool AllMatch(const Type* t, bool is_init) const;
-	bool AllMatch(const IntrusivePtr<Type>& t, bool is_init) const
+	bool AllMatch(const zeek::IntrusivePtr<Type>& t, bool is_init) const
 		{ return AllMatch(t.get(), is_init); }
 
-	void Append(IntrusivePtr<Type> t);
-	void AppendEvenIfNotPure(IntrusivePtr<Type> t);
+	void Append(zeek::IntrusivePtr<Type> t);
+	void AppendEvenIfNotPure(zeek::IntrusivePtr<Type> t);
 
 	void Describe(ODesc* d) const override;
 
 	unsigned int MemoryAllocation() const override;
 
 protected:
-	IntrusivePtr<Type> pure_type;
-	std::vector<IntrusivePtr<Type>> types;
+	zeek::IntrusivePtr<Type> pure_type;
+	std::vector<zeek::IntrusivePtr<Type>> types;
 
 	// Remove in v4.1. This is used by Types(), which is deprecated.
 	type_list types_list;
@@ -413,7 +415,7 @@ public:
 
 	int MatchesIndex(zeek::detail::ListExpr* index) const override;
 
-	const IntrusivePtr<TypeList>& GetIndices() const
+	const zeek::IntrusivePtr<TypeList>& GetIndices() const
 		{ return indices; }
 
 	[[deprecated("Remove in v4.1. Use GetIndices().")]]
@@ -423,10 +425,10 @@ public:
 	const type_list* IndexTypes() const
 		{ return indices->Types(); }
 
-	const std::vector<IntrusivePtr<Type>>& GetIndexTypes() const
+	const std::vector<zeek::IntrusivePtr<Type>>& GetIndexTypes() const
 		{ return indices->GetTypes(); }
 
-	const IntrusivePtr<Type>& Yield() const override
+	const zeek::IntrusivePtr<Type>& Yield() const override
 		{ return yield_type; }
 
 	void Describe(ODesc* d) const override;
@@ -436,8 +438,8 @@ public:
 	bool IsSubNetIndex() const;
 
 protected:
-	IndexType(TypeTag t, IntrusivePtr<TypeList> arg_indices,
-	          IntrusivePtr<Type> arg_yield_type)
+	IndexType(TypeTag t, zeek::IntrusivePtr<TypeList> arg_indices,
+	          zeek::IntrusivePtr<Type> arg_yield_type)
 		: Type(t), indices(std::move(arg_indices)),
 		  yield_type(std::move(arg_yield_type))
 		{
@@ -445,15 +447,15 @@ protected:
 
 	~IndexType() override = default;
 
-	IntrusivePtr<TypeList> indices;
-	IntrusivePtr<Type> yield_type;
+	zeek::IntrusivePtr<TypeList> indices;
+	zeek::IntrusivePtr<Type> yield_type;
 };
 
 class TableType : public IndexType {
 public:
-	TableType(IntrusivePtr<TypeList> ind, IntrusivePtr<Type> yield);
+	TableType(zeek::IntrusivePtr<TypeList> ind, zeek::IntrusivePtr<Type> yield);
 
-	IntrusivePtr<Type> ShallowClone() override;
+	zeek::IntrusivePtr<Type> ShallowClone() override;
 
 	// Returns true if this table type is "unspecified", which is
 	// what one gets using an empty "set()" or "table()" constructor.
@@ -462,24 +464,24 @@ public:
 
 class SetType final : public TableType {
 public:
-	SetType(IntrusivePtr<TypeList> ind, IntrusivePtr<zeek::detail::ListExpr> arg_elements);
+	SetType(zeek::IntrusivePtr<TypeList> ind, zeek::IntrusivePtr<zeek::detail::ListExpr> arg_elements);
 	~SetType() override;
 
-	IntrusivePtr<Type> ShallowClone() override;
+	zeek::IntrusivePtr<Type> ShallowClone() override;
 
 	[[deprecated("Remove in v4.1.  Use Elements() isntead.")]]
 	zeek::detail::ListExpr* SetElements() const	{ return elements.get(); }
 
-	const IntrusivePtr<zeek::detail::ListExpr>& Elements() const
+	const zeek::IntrusivePtr<zeek::detail::ListExpr>& Elements() const
 		{ return elements; }
 
 protected:
-	IntrusivePtr<zeek::detail::ListExpr> elements;
+	zeek::IntrusivePtr<zeek::detail::ListExpr> elements;
 };
 
 class FuncType final : public Type {
 public:
-	static inline const IntrusivePtr<FuncType> nil;
+	static inline const zeek::IntrusivePtr<FuncType> nil;
 
 	/**
 	 * Prototype is only currently used for events and hooks which declare
@@ -488,27 +490,27 @@ public:
 	 */
 	struct Prototype {
 		bool deprecated;
-		IntrusivePtr<RecordType> args;
+		zeek::IntrusivePtr<RecordType> args;
 		std::map<int, int> offsets;
 	};
 
-	FuncType(IntrusivePtr<RecordType> args, IntrusivePtr<Type> yield,
+	FuncType(zeek::IntrusivePtr<RecordType> args, zeek::IntrusivePtr<Type> yield,
 	         FunctionFlavor f);
 
-	IntrusivePtr<Type> ShallowClone() override;
+	zeek::IntrusivePtr<Type> ShallowClone() override;
 
 	~FuncType() override;
 
 	[[deprecated("Remove in v4.1.  Use Params().")]]
 	RecordType* Args() const	{ return args.get(); }
 
-	const IntrusivePtr<RecordType>& Params() const
+	const zeek::IntrusivePtr<RecordType>& Params() const
 		{ return args; }
 
-	const IntrusivePtr<Type>& Yield() const override
+	const zeek::IntrusivePtr<Type>& Yield() const override
 		{ return yield; }
 
-	void SetYieldType(IntrusivePtr<Type> arg_yield)	{ yield = std::move(arg_yield); }
+	void SetYieldType(zeek::IntrusivePtr<Type> arg_yield)	{ yield = std::move(arg_yield); }
 	FunctionFlavor Flavor() const { return flavor; }
 	std::string FlavorString() const;
 
@@ -518,13 +520,13 @@ public:
 
 	int MatchesIndex(zeek::detail::ListExpr* index) const override;
 	bool CheckArgs(const type_list* args, bool is_init = false) const;
-	bool CheckArgs(const std::vector<IntrusivePtr<Type>>& args,
+	bool CheckArgs(const std::vector<zeek::IntrusivePtr<Type>>& args,
 	               bool is_init = false) const;
 
 	[[deprecated("Remove in v4.1.  Use ParamList().")]]
 	TypeList* ArgTypes() const	{ return arg_types.get(); }
 
-	const IntrusivePtr<TypeList>& ParamList() const
+	const zeek::IntrusivePtr<TypeList>& ParamList() const
 		{ return arg_types; }
 
 	void Describe(ODesc* d) const override;
@@ -547,27 +549,27 @@ public:
 		{ return prototypes; }
 
 protected:
-	friend IntrusivePtr<FuncType> make_intrusive<FuncType>();
+	friend zeek::IntrusivePtr<FuncType> zeek::make_intrusive<FuncType>();
 
 	FuncType() : Type(TYPE_FUNC) { flavor = FUNC_FLAVOR_FUNCTION; }
-	IntrusivePtr<RecordType> args;
-	IntrusivePtr<TypeList> arg_types;
-	IntrusivePtr<Type> yield;
+	zeek::IntrusivePtr<RecordType> args;
+	zeek::IntrusivePtr<TypeList> arg_types;
+	zeek::IntrusivePtr<Type> yield;
 	FunctionFlavor flavor;
 	std::vector<Prototype> prototypes;
 };
 
 class TypeType final : public Type {
 public:
-	explicit TypeType(IntrusivePtr<Type> t) : zeek::Type(TYPE_TYPE), type(std::move(t)) {}
-	IntrusivePtr<Type> ShallowClone() override { return make_intrusive<TypeType>(type); }
+	explicit TypeType(zeek::IntrusivePtr<Type> t) : zeek::Type(TYPE_TYPE), type(std::move(t)) {}
+	zeek::IntrusivePtr<Type> ShallowClone() override { return zeek::make_intrusive<TypeType>(type); }
 
-	const IntrusivePtr<Type>& GetType() const
+	const zeek::IntrusivePtr<Type>& GetType() const
 		{ return type; }
 
 	template <class T>
-	IntrusivePtr<T> GetType() const
-		{ return cast_intrusive<T>(type); }
+	zeek::IntrusivePtr<T> GetType() const
+		{ return zeek::cast_intrusive<T>(type); }
 
 	[[deprecated("Remove in v4.1.  Use GetType().")]]
 	zeek::Type* Type()			{ return type.get(); }
@@ -575,24 +577,24 @@ public:
 	const zeek::Type* Type() const	{ return type.get(); }
 
 protected:
-	IntrusivePtr<zeek::Type> type;
+	zeek::IntrusivePtr<zeek::Type> type;
 };
 
 class TypeDecl final {
 public:
 	TypeDecl() = default;
-	TypeDecl(const char* i, IntrusivePtr<Type> t,
-	         IntrusivePtr<zeek::detail::Attributes> attrs = nullptr);
+	TypeDecl(const char* i, zeek::IntrusivePtr<Type> t,
+	         zeek::IntrusivePtr<zeek::detail::Attributes> attrs = nullptr);
 	TypeDecl(const TypeDecl& other);
 	~TypeDecl();
 
-	const IntrusivePtr<zeek::detail::Attr>& GetAttr(zeek::detail::AttrTag a) const
+	const zeek::IntrusivePtr<zeek::detail::Attr>& GetAttr(zeek::detail::AttrTag a) const
 		{ return attrs ? attrs->Find(a) : zeek::detail::Attr::nil; }
 
 	void DescribeReST(ODesc* d, bool roles_only = false) const;
 
-	IntrusivePtr<Type> type;
-	IntrusivePtr<zeek::detail::Attributes> attrs;
+	zeek::IntrusivePtr<Type> type;
+	zeek::IntrusivePtr<zeek::detail::Attributes> attrs;
 	const char* id = nullptr;
 };
 
@@ -601,7 +603,7 @@ using type_decl_list = PList<TypeDecl>;
 class RecordType final : public Type {
 public:
 	explicit RecordType(type_decl_list* types);
-	IntrusivePtr<Type> ShallowClone() override;
+	zeek::IntrusivePtr<Type> ShallowClone() override;
 
 	~RecordType() override;
 
@@ -622,7 +624,7 @@ public:
 	 * Looks up a field by name and returns its type.  No check for invalid
 	 * field name is performed.
 	 */
-	const IntrusivePtr<Type>& GetFieldType(const char* field_name) const
+	const zeek::IntrusivePtr<Type>& GetFieldType(const char* field_name) const
 		{ return GetFieldType(FieldOffset(field_name)); }
 
 	/**
@@ -630,14 +632,14 @@ public:
 	 * No check for invalid field name is performed.
 	 */
 	template <class T>
-	IntrusivePtr<T> GetFieldType(const char* field_name) const
-		{ return cast_intrusive<T>(GetFieldType(field_name)); }
+	zeek::IntrusivePtr<T> GetFieldType(const char* field_name) const
+		{ return zeek::cast_intrusive<T>(GetFieldType(field_name)); }
 
 	/**
 	 * Looks up a field by its index and returns its type.  No check for
 	 * invalid field offset is performed.
 	 */
-	const IntrusivePtr<Type>& GetFieldType(int field_index) const
+	const zeek::IntrusivePtr<Type>& GetFieldType(int field_index) const
 		{ return (*types)[field_index]->type; }
 
 	/**
@@ -645,10 +647,10 @@ public:
 	 * No check for invalid field offset is performed.
 	 */
 	template <class T>
-	IntrusivePtr<T> GetFieldType(int field_index) const
-		{ return cast_intrusive<T>((*types)[field_index]->type); }
+	zeek::IntrusivePtr<T> GetFieldType(int field_index) const
+		{ return zeek::cast_intrusive<T>((*types)[field_index]->type); }
 
-	IntrusivePtr<Val> FieldDefault(int field) const;
+	zeek::IntrusivePtr<Val> FieldDefault(int field) const;
 
 	// A field's offset is its position in the type_decl_list,
 	// starting at 0.  Returns negative if the field doesn't exist.
@@ -670,7 +672,7 @@ public:
 	 * @param rv  an optional record value, if given the values of
 	 * all fields will be provided in the returned table.
 	 */
-	IntrusivePtr<TableVal> GetRecordFieldsVal(const RecordVal* rv = nullptr) const;
+	zeek::IntrusivePtr<TableVal> GetRecordFieldsVal(const RecordVal* rv = nullptr) const;
 
 	// Returns null if all is ok, otherwise a pointer to an error message.
 	const char* AddFields(const type_decl_list& types,
@@ -710,23 +712,23 @@ public:
 
 class FileType final : public Type {
 public:
-	explicit FileType(IntrusivePtr<Type> yield_type);
-	IntrusivePtr<Type> ShallowClone() override { return make_intrusive<FileType>(yield); }
+	explicit FileType(zeek::IntrusivePtr<Type> yield_type);
+	zeek::IntrusivePtr<Type> ShallowClone() override { return zeek::make_intrusive<FileType>(yield); }
 	~FileType() override;
 
-	const IntrusivePtr<Type>& Yield() const override
+	const zeek::IntrusivePtr<Type>& Yield() const override
 		{ return yield; }
 
 	void Describe(ODesc* d) const override;
 
 protected:
-	IntrusivePtr<Type> yield;
+	zeek::IntrusivePtr<Type> yield;
 };
 
 class OpaqueType final : public Type {
 public:
 	explicit OpaqueType(const std::string& name);
-	IntrusivePtr<Type> ShallowClone() override { return make_intrusive<OpaqueType>(name); }
+	zeek::IntrusivePtr<Type> ShallowClone() override { return zeek::make_intrusive<OpaqueType>(name); }
 	~OpaqueType() override { };
 
 	const std::string& Name() const { return name; }
@@ -746,7 +748,7 @@ public:
 
 	explicit EnumType(const EnumType* e);
 	explicit EnumType(const std::string& arg_name);
-	IntrusivePtr<Type> ShallowClone() override;
+	zeek::IntrusivePtr<Type> ShallowClone() override;
 	~EnumType() override;
 
 	// The value of this name is next internal counter value, starting
@@ -768,7 +770,7 @@ public:
 
 	void DescribeReST(ODesc* d, bool roles_only = false) const override;
 
-	const IntrusivePtr<EnumVal>& GetVal(bro_int_t i);
+	const zeek::IntrusivePtr<EnumVal>& GetVal(bro_int_t i);
 
 protected:
 	void AddNameInternal(const std::string& module_name,
@@ -781,7 +783,7 @@ protected:
 	typedef std::map<std::string, bro_int_t> NameMap;
 	NameMap names;
 
-	using ValMap = std::unordered_map<bro_int_t, IntrusivePtr<EnumVal>>;
+	using ValMap = std::unordered_map<bro_int_t, zeek::IntrusivePtr<EnumVal>>;
 	ValMap vals;
 
 	// The counter is initialized to 0 and incremented on every implicit
@@ -795,11 +797,11 @@ protected:
 
 class VectorType final : public Type {
 public:
-	explicit VectorType(IntrusivePtr<Type> t);
-	IntrusivePtr<Type> ShallowClone() override;
+	explicit VectorType(zeek::IntrusivePtr<Type> t);
+	zeek::IntrusivePtr<Type> ShallowClone() override;
 	~VectorType() override;
 
-	const IntrusivePtr<Type>& Yield() const override;
+	const zeek::IntrusivePtr<Type>& Yield() const override;
 
 	int MatchesIndex(zeek::detail::ListExpr* index) const override;
 
@@ -811,7 +813,7 @@ public:
 	void DescribeReST(ODesc* d, bool roles_only = false) const override;
 
 protected:
-	IntrusivePtr<Type> yield_type;
+	zeek::IntrusivePtr<Type> yield_type;
 };
 
 // True if the two types are equivalent.  If is_init is true then the test is
@@ -819,16 +821,16 @@ protected:
 // true then for record types the field names have to match, too.
 extern bool same_type(const Type& t1, const Type& t2,
                       bool is_init=false, bool match_record_field_names=true);
-inline bool same_type(const IntrusivePtr<Type>& t1, const IntrusivePtr<Type>& t2,
+inline bool same_type(const zeek::IntrusivePtr<Type>& t1, const zeek::IntrusivePtr<Type>& t2,
                       bool is_init=false, bool match_record_field_names=true)
     { return same_type(*t1, *t2, is_init, match_record_field_names); }
 inline bool same_type(const Type* t1, const Type* t2,
                       bool is_init=false, bool match_record_field_names=true)
     { return same_type(*t1, *t2, is_init, match_record_field_names); }
-inline bool same_type(const IntrusivePtr<Type>& t1, const Type* t2,
+inline bool same_type(const zeek::IntrusivePtr<Type>& t1, const Type* t2,
                       bool is_init=false, bool match_record_field_names=true)
     { return same_type(*t1, *t2, is_init, match_record_field_names); }
-inline bool same_type(const Type* t1, const IntrusivePtr<Type>& t2,
+inline bool same_type(const Type* t1, const zeek::IntrusivePtr<Type>& t2,
                       bool is_init=false, bool match_record_field_names=true)
     { return same_type(*t1, *t2, is_init, match_record_field_names); }
 
@@ -851,22 +853,22 @@ extern TypeTag max_type(TypeTag t1, TypeTag t2);
 // Given two types, returns the "merge", in which promotable types
 // are promoted to the maximum of the two.  Returns nil (and generates
 // an error message) if the types are incompatible.
-IntrusivePtr<Type> merge_types(const IntrusivePtr<Type>& t1,
-                                  const IntrusivePtr<Type>& t2);
+zeek::IntrusivePtr<Type> merge_types(const zeek::IntrusivePtr<Type>& t1,
+                                  const zeek::IntrusivePtr<Type>& t2);
 
 // Given a list of expressions, returns a (ref'd) type reflecting
 // a merged type consistent across all of them, or nil if this
 // cannot be done.
-IntrusivePtr<Type> merge_type_list(zeek::detail::ListExpr* elements);
+zeek::IntrusivePtr<Type> merge_type_list(zeek::detail::ListExpr* elements);
 
 // Given an expression, infer its type when used for an initialization.
-IntrusivePtr<Type> init_type(zeek::detail::Expr* init);
+zeek::IntrusivePtr<Type> init_type(zeek::detail::Expr* init);
 
 // Returns true if argument is an atomic type.
 bool is_atomic_type(const Type& t);
 inline bool is_atomic_type(const Type* t)
 	{ return is_atomic_type(*t); }
-inline bool is_atomic_type(const IntrusivePtr<Type>& t)
+inline bool is_atomic_type(const zeek::IntrusivePtr<Type>& t)
 	{ return is_atomic_type(*t); }
 
 // True if the given type tag corresponds to type that can be assigned to.
@@ -923,10 +925,10 @@ inline bool BothString(TypeTag t1, TypeTag t2) { return (IsString(t1) && IsStrin
 inline bool EitherError(TypeTag t1, TypeTag t2) { return (IsErrorType(t1) || IsErrorType(t2)); }
 
 // Returns the basic (non-parameterized) type with the given type.
-const IntrusivePtr<zeek::Type>& base_type(zeek::TypeTag tag);
+const zeek::IntrusivePtr<Type>& base_type(zeek::TypeTag tag);
 
 // Returns the basic error type.
-inline const IntrusivePtr<zeek::Type>& error_type()       { return base_type(TYPE_ERROR); }
+inline const zeek::IntrusivePtr<Type>& error_type()       { return base_type(TYPE_ERROR); }
 
 } // namespace zeek
 
@@ -936,16 +938,16 @@ inline const IntrusivePtr<zeek::Type>& error_type()       { return base_type(TYP
 inline zeek::Type* base_type_no_ref(zeek::TypeTag tag)
 	{ return zeek::base_type(tag).get(); }
 
-extern IntrusivePtr<zeek::OpaqueType> md5_type;
-extern IntrusivePtr<zeek::OpaqueType> sha1_type;
-extern IntrusivePtr<zeek::OpaqueType> sha256_type;
-extern IntrusivePtr<zeek::OpaqueType> entropy_type;
-extern IntrusivePtr<zeek::OpaqueType> cardinality_type;
-extern IntrusivePtr<zeek::OpaqueType> topk_type;
-extern IntrusivePtr<zeek::OpaqueType> bloomfilter_type;
-extern IntrusivePtr<zeek::OpaqueType> x509_opaque_type;
-extern IntrusivePtr<zeek::OpaqueType> ocsp_resp_opaque_type;
-extern IntrusivePtr<zeek::OpaqueType> paraglob_type;
+extern zeek::IntrusivePtr<zeek::OpaqueType> md5_type;
+extern zeek::IntrusivePtr<zeek::OpaqueType> sha1_type;
+extern zeek::IntrusivePtr<zeek::OpaqueType> sha256_type;
+extern zeek::IntrusivePtr<zeek::OpaqueType> entropy_type;
+extern zeek::IntrusivePtr<zeek::OpaqueType> cardinality_type;
+extern zeek::IntrusivePtr<zeek::OpaqueType> topk_type;
+extern zeek::IntrusivePtr<zeek::OpaqueType> bloomfilter_type;
+extern zeek::IntrusivePtr<zeek::OpaqueType> x509_opaque_type;
+extern zeek::IntrusivePtr<zeek::OpaqueType> ocsp_resp_opaque_type;
+extern zeek::IntrusivePtr<zeek::OpaqueType> paraglob_type;
 
 using BroType [[deprecated("Remove in v4.1. Use zeek::Type instead.")]] = zeek::Type;
 using TypeList [[deprecated("Remove in v4.1. Use zeek::TypeList instead.")]] = zeek::TypeList;
diff --git a/src/Val.cc b/src/Val.cc
index 1f7a39b1d1..f64b4032e1 100644
--- a/src/Val.cc
+++ b/src/Val.cc
@@ -42,25 +42,25 @@
 
 using namespace std;
 
-Val::Val(Func* f) : Val({NewRef{}, f})
+Val::Val(Func* f) : Val({zeek::NewRef{}, f})
 	{}
 
-Val::Val(IntrusivePtr<Func> f)
+Val::Val(zeek::IntrusivePtr<Func> f)
 	: val(f.release()), type(val.func_val->GetType())
 	{}
 
-static const IntrusivePtr<zeek::FileType>& GetStringFileType() noexcept
+static const zeek::IntrusivePtr<zeek::FileType>& GetStringFileType() noexcept
 	{
-	static IntrusivePtr<zeek::FileType> string_file_type
-		= make_intrusive<zeek::FileType>(zeek::base_type(zeek::TYPE_STRING));
+	static zeek::IntrusivePtr<zeek::FileType> string_file_type
+		= zeek::make_intrusive<zeek::FileType>(zeek::base_type(zeek::TYPE_STRING));
 
 	return string_file_type;
 	}
 
-Val::Val(BroFile* f) : Val({AdoptRef{}, f})
+Val::Val(BroFile* f) : Val({zeek::AdoptRef{}, f})
 	{}
 
-Val::Val(IntrusivePtr<BroFile> f)
+Val::Val(zeek::IntrusivePtr<BroFile> f)
 	: val(f.release()), type(GetStringFileType())
 	{
 	assert(val.file_val->GetType()->Tag() == zeek::TYPE_STRING);
@@ -82,24 +82,24 @@ Val::~Val()
 #endif
 	}
 
-IntrusivePtr<Val> Val::CloneState::NewClone(Val* src, IntrusivePtr<Val> dst)
+zeek::IntrusivePtr<Val> Val::CloneState::NewClone(Val* src, zeek::IntrusivePtr<Val> dst)
 	{
 	clones.insert(std::make_pair(src, dst.get()));
 	return dst;
 	}
 
-IntrusivePtr<Val> Val::Clone()
+zeek::IntrusivePtr<Val> Val::Clone()
 	{
 	Val::CloneState state;
 	return Clone(&state);
 	}
 
-IntrusivePtr<Val> Val::Clone(CloneState* state)
+zeek::IntrusivePtr<Val> Val::Clone(CloneState* state)
 	{
 	auto i = state->clones.find(this);
 
 	if ( i != state->clones.end() )
-		return {NewRef{}, i->second};
+		return {zeek::NewRef{}, i->second};
 
 	auto c = DoClone(state);
 
@@ -109,20 +109,20 @@ IntrusivePtr<Val> Val::Clone(CloneState* state)
 	return c;
 	}
 
-IntrusivePtr<Val> Val::DoClone(CloneState* state)
+zeek::IntrusivePtr<Val> Val::DoClone(CloneState* state)
 	{
 	switch ( type->InternalType() ) {
 	case zeek::TYPE_INTERNAL_INT:
 	case zeek::TYPE_INTERNAL_UNSIGNED:
 	case zeek::TYPE_INTERNAL_DOUBLE:
 	 	// Immutable.
-		return {NewRef{}, this};
+		return {zeek::NewRef{}, this};
 
 	case zeek::TYPE_INTERNAL_OTHER:
 		// Derived classes are responsible for this. Exception:
 		// Functions and files. There aren't any derived classes.
 		if ( type->Tag() == zeek::TYPE_FUNC )
-			return make_intrusive<Val>(AsFunc()->DoClone());
+			return zeek::make_intrusive<Val>(AsFunc()->DoClone());
 
 		if ( type->Tag() == zeek::TYPE_FILE )
 			{
@@ -136,12 +136,12 @@ IntrusivePtr<Val> Val::DoClone(CloneState* state)
 			// automatically opened. This does not happen anymore - instead you
 			// get the non-cached pointer back which is brought back into the
 			// cache when written too.
-			return {NewRef{}, this};
+			return {zeek::NewRef{}, this};
 			}
 
 		if ( type->Tag() == zeek::TYPE_TYPE )
 			// These are immutable, essentially.
-			return {NewRef{}, this};
+			return {zeek::NewRef{}, this};
 
 		// Fall-through.
 
@@ -153,10 +153,10 @@ IntrusivePtr<Val> Val::DoClone(CloneState* state)
 	return nullptr;
  	}
 
-IntrusivePtr<Func> Val::AsFuncPtr() const
+zeek::IntrusivePtr<Func> Val::AsFuncPtr() const
 	{
 	CHECK_TAG(type->Tag(), zeek::TYPE_FUNC, "Val::Func", zeek::type_name)
-	return {NewRef{}, val.func_val};
+	return {zeek::NewRef{}, val.func_val};
 	}
 
 bool Val::IsZero() const
@@ -256,7 +256,7 @@ double Val::CoerceToDouble() const
 	return 0.0;
 	}
 
-IntrusivePtr<Val> Val::SizeVal() const
+zeek::IntrusivePtr<Val> Val::SizeVal() const
 	{
 	switch ( type->InternalType() ) {
 	case zeek::TYPE_INTERNAL_INT:
@@ -271,14 +271,14 @@ IntrusivePtr<Val> Val::SizeVal() const
 		return val_mgr->Count(val.uint_val);
 
 	case zeek::TYPE_INTERNAL_DOUBLE:
-		return make_intrusive<DoubleVal>(fabs(val.double_val));
+		return zeek::make_intrusive<DoubleVal>(fabs(val.double_val));
 
 	case zeek::TYPE_INTERNAL_OTHER:
 		if ( type->Tag() == zeek::TYPE_FUNC )
 			return val_mgr->Count(val.func_val->GetType()->ParamList()->GetTypes().size());
 
 		if ( type->Tag() == zeek::TYPE_FILE )
-			return make_intrusive<DoubleVal>(val.file_val->Size());
+			return zeek::make_intrusive<DoubleVal>(val.file_val->Size());
 		break;
 
 	default:
@@ -419,7 +419,7 @@ bool Val::WouldOverflow(const zeek::Type* from_type, const zeek::Type* to_type,
 	return false;
 	}
 
-IntrusivePtr<TableVal> Val::GetRecordFields()
+zeek::IntrusivePtr<TableVal> Val::GetRecordFields()
 	{
 	static auto record_field_table = zeek::id::find_type<zeek::TableType>("record_field_table");
 	auto t = GetType().get();
@@ -427,7 +427,7 @@ IntrusivePtr<TableVal> Val::GetRecordFields()
 	if ( t->Tag() != zeek::TYPE_RECORD && t->Tag() != zeek::TYPE_TYPE )
 		{
 		reporter->Error("non-record value/type passed to record_fields");
-		return make_intrusive<TableVal>(record_field_table);
+		return zeek::make_intrusive<TableVal>(record_field_table);
 		}
 
 	zeek::RecordType* rt = nullptr;
@@ -445,7 +445,7 @@ IntrusivePtr<TableVal> Val::GetRecordFields()
 		if ( t->Tag() != zeek::TYPE_RECORD )
 			{
 			reporter->Error("non-record value/type passed to record_fields");
-			return make_intrusive<TableVal>(record_field_table);
+			return zeek::make_intrusive<TableVal>(record_field_table);
 			}
 
 		rt = t->AsRecordType();
@@ -595,8 +595,8 @@ static void BuildJSON(threading::formatter::JSON::NullDoubleWriter& writer, Val*
 
 					if ( re && re->MatchAnywhere(field_name) != 0 )
 						{
-						auto blank = make_intrusive<StringVal>("");
-						auto fn_val = make_intrusive<StringVal>(field_name);
+						auto blank = zeek::make_intrusive<StringVal>("");
+						auto fn_val = zeek::make_intrusive<StringVal>(field_name);
 						const auto& bs = *blank->AsString();
 						auto key_val = fn_val->Replace(re, bs, false);
 						key_str = key_val->ToStdString();
@@ -656,14 +656,14 @@ static void BuildJSON(threading::formatter::JSON::NullDoubleWriter& writer, Val*
 		}
 	}
 
-IntrusivePtr<StringVal> Val::ToJSON(bool only_loggable, RE_Matcher* re)
+zeek::IntrusivePtr<StringVal> Val::ToJSON(bool only_loggable, RE_Matcher* re)
 	{
 	rapidjson::StringBuffer buffer;
 	threading::formatter::JSON::NullDoubleWriter writer(buffer);
 
 	BuildJSON(writer, this, only_loggable, re, "");
 
-	return make_intrusive<StringVal>(buffer.GetString());
+	return zeek::make_intrusive<StringVal>(buffer.GetString());
 	}
 
 void IntervalVal::ValDescribe(ODesc* d) const
@@ -739,7 +739,7 @@ void IntervalVal::ValDescribe(ODesc* d) const
 		}
 	}
 
-IntrusivePtr<Val> PortVal::SizeVal() const
+zeek::IntrusivePtr<Val> PortVal::SizeVal() const
 	{
 	return val_mgr->Int(val.uint_val);
 	}
@@ -820,10 +820,10 @@ void PortVal::ValDescribe(ODesc* d) const
 	d->Add(Protocol());
 	}
 
-IntrusivePtr<Val> PortVal::DoClone(CloneState* state)
+zeek::IntrusivePtr<Val> PortVal::DoClone(CloneState* state)
 	{
 	// Immutable.
-	return {NewRef{}, this};
+	return {zeek::NewRef{}, this};
 	}
 
 AddrVal::AddrVal(const char* text) : Val(new IPAddr(text), zeek::TYPE_ADDR)
@@ -857,7 +857,7 @@ unsigned int AddrVal::MemoryAllocation() const
 	return padded_sizeof(*this) + val.addr_val->MemoryAllocation();
 	}
 
-IntrusivePtr<Val> AddrVal::SizeVal() const
+zeek::IntrusivePtr<Val> AddrVal::SizeVal() const
 	{
 	if ( val.addr_val->GetFamily() == IPv4 )
 		return val_mgr->Count(32);
@@ -865,10 +865,10 @@ IntrusivePtr<Val> AddrVal::SizeVal() const
 		return val_mgr->Count(128);
 	}
 
-IntrusivePtr<Val> AddrVal::DoClone(CloneState* state)
+zeek::IntrusivePtr<Val> AddrVal::DoClone(CloneState* state)
 	{
 	// Immutable.
-	return {NewRef{}, this};
+	return {zeek::NewRef{}, this};
 	}
 
 SubNetVal::SubNetVal(const char* text) : Val(new IPPrefix(), zeek::TYPE_SUBNET)
@@ -917,10 +917,10 @@ unsigned int SubNetVal::MemoryAllocation() const
 	return padded_sizeof(*this) + val.subnet_val->MemoryAllocation();
 	}
 
-IntrusivePtr<Val> SubNetVal::SizeVal() const
+zeek::IntrusivePtr<Val> SubNetVal::SizeVal() const
 	{
 	int retained = 128 - val.subnet_val->LengthIPv6();
-	return make_intrusive<DoubleVal>(pow(2.0, double(retained)));
+	return zeek::make_intrusive<DoubleVal>(pow(2.0, double(retained)));
 	}
 
 void SubNetVal::ValDescribe(ODesc* d) const
@@ -962,10 +962,10 @@ bool SubNetVal::Contains(const IPAddr& addr) const
 	return val.subnet_val->Contains(addr);
 	}
 
-IntrusivePtr<Val> SubNetVal::DoClone(CloneState* state)
+zeek::IntrusivePtr<Val> SubNetVal::DoClone(CloneState* state)
 	{
 	// Immutable.
-	return {NewRef{}, this};
+	return {zeek::NewRef{}, this};
 	}
 
 StringVal::StringVal(BroString* s) : Val(s, zeek::TYPE_STRING)
@@ -986,7 +986,7 @@ StringVal::StringVal(const string& s) : StringVal(s.length(), s.data())
 	{
 	}
 
-IntrusivePtr<Val> StringVal::SizeVal() const
+zeek::IntrusivePtr<Val> StringVal::SizeVal() const
 	{
 	return val_mgr->Count(val.string_val->Len());
 	}
@@ -1033,8 +1033,8 @@ unsigned int StringVal::MemoryAllocation() const
 	return padded_sizeof(*this) + val.string_val->MemoryAllocation();
 	}
 
-IntrusivePtr<StringVal> StringVal::Replace(RE_Matcher* re,
-                                           const BroString& repl, bool do_all)
+zeek::IntrusivePtr<StringVal> StringVal::Replace(
+	RE_Matcher* re, const BroString& repl, bool do_all)
 	{
 	const u_char* s = Bytes();
 	int offset = 0;
@@ -1115,15 +1115,15 @@ IntrusivePtr<StringVal> StringVal::Replace(RE_Matcher* re,
 	// the NUL.
 	r[0] = '\0';
 
-	return make_intrusive<StringVal>(new BroString(true, result, r - result));
+	return zeek::make_intrusive<StringVal>(new BroString(true, result, r - result));
 	}
 
-IntrusivePtr<Val> StringVal::DoClone(CloneState* state)
+zeek::IntrusivePtr<Val> StringVal::DoClone(CloneState* state)
 	{
 	// We could likely treat this type as immutable and return a reference
 	// instead of creating a new copy, but we first need to be careful and
 	// audit whether anything internal actually does mutate it.
-	return state->NewClone(this, make_intrusive<StringVal>(
+	return state->NewClone(this, zeek::make_intrusive<StringVal>(
 	        new BroString((u_char*) val.string_val->Bytes(),
 	                      val.string_val->Len(), true)));
 	}
@@ -1176,7 +1176,7 @@ unsigned int PatternVal::MemoryAllocation() const
 	return padded_sizeof(*this) + val.re_val->MemoryAllocation();
 	}
 
-IntrusivePtr<Val> PatternVal::DoClone(CloneState* state)
+zeek::IntrusivePtr<Val> PatternVal::DoClone(CloneState* state)
 	{
 	// We could likely treat this type as immutable and return a reference
 	// instead of creating a new copy, but we first need to be careful and
@@ -1184,11 +1184,11 @@ IntrusivePtr<Val> PatternVal::DoClone(CloneState* state)
 	auto re = new RE_Matcher(val.re_val->PatternText(),
 	                         val.re_val->AnywherePatternText());
 	re->Compile();
-	return state->NewClone(this, make_intrusive<PatternVal>(re));
+	return state->NewClone(this, zeek::make_intrusive<PatternVal>(re));
 	}
 
 ListVal::ListVal(zeek::TypeTag t)
-	: Val(make_intrusive<zeek::TypeList>(t == zeek::TYPE_ANY ? nullptr : zeek::base_type(t)))
+	: Val(zeek::make_intrusive<zeek::TypeList>(t == zeek::TYPE_ANY ? nullptr : zeek::base_type(t)))
 	{
 	tag = t;
 	}
@@ -1197,7 +1197,7 @@ ListVal::~ListVal()
 	{
 	}
 
-IntrusivePtr<Val> ListVal::SizeVal() const
+zeek::IntrusivePtr<Val> ListVal::SizeVal() const
 	{
 	return val_mgr->Count(vals.size());
 	}
@@ -1217,7 +1217,7 @@ RE_Matcher* ListVal::BuildRE() const
 	return re;
 	}
 
-void ListVal::Append(IntrusivePtr<Val> v)
+void ListVal::Append(zeek::IntrusivePtr<Val> v)
 	{
 	if ( type->AsTypeList()->IsPure() )
 		{
@@ -1232,19 +1232,19 @@ void ListVal::Append(IntrusivePtr<Val> v)
 
 void ListVal::Append(Val* v)
 	{
-	Append({AdoptRef{}, v});
+	Append({zeek::AdoptRef{}, v});
 	}
 
-IntrusivePtr<TableVal> ListVal::ToSetVal() const
+zeek::IntrusivePtr<TableVal> ListVal::ToSetVal() const
 	{
 	if ( tag == zeek::TYPE_ANY )
 		Internal("conversion of heterogeneous list to set");
 
 	const auto& pt = type->AsTypeList()->GetPureType();
-	auto set_index = make_intrusive<zeek::TypeList>(pt);
+	auto set_index = zeek::make_intrusive<zeek::TypeList>(pt);
 	set_index->Append(zeek::base_type(tag));
-	auto s = make_intrusive<zeek::SetType>(std::move(set_index), nullptr);
-	auto t = make_intrusive<TableVal>(std::move(s));
+	auto s = zeek::make_intrusive<zeek::SetType>(std::move(set_index), nullptr);
+	auto t = zeek::make_intrusive<TableVal>(std::move(s));
 
 	for ( const auto& val : vals )
 		t->Assign(val, nullptr);
@@ -1282,9 +1282,9 @@ void ListVal::Describe(ODesc* d) const
 		}
 	}
 
-IntrusivePtr<Val> ListVal::DoClone(CloneState* state)
+zeek::IntrusivePtr<Val> ListVal::DoClone(CloneState* state)
 	{
-	auto lv = make_intrusive<ListVal>(tag);
+	auto lv = zeek::make_intrusive<ListVal>(tag);
 	lv->vals.reserve(vals.size());
 	state->NewClone(this, lv);
 
@@ -1336,7 +1336,7 @@ static void table_entry_val_delete_func(void* val)
 	delete tv;
 	}
 
-static void find_nested_record_types(const IntrusivePtr<zeek::Type>& t, std::set<zeek::RecordType*>* found)
+static void find_nested_record_types(const zeek::IntrusivePtr<zeek::Type>& t, std::set<zeek::RecordType*>* found)
 	{
 	if ( ! t )
 		return;
@@ -1376,7 +1376,7 @@ static void find_nested_record_types(const IntrusivePtr<zeek::Type>& t, std::set
 	}
 	}
 
-TableVal::TableVal(IntrusivePtr<zeek::TableType> t, IntrusivePtr<zeek::detail::Attributes> a) : Val(t)
+TableVal::TableVal(zeek::IntrusivePtr<zeek::TableType> t, zeek::IntrusivePtr<zeek::detail::Attributes> a) : Val(t)
 	{
 	Init(std::move(t));
 	SetAttrs(std::move(a));
@@ -1392,11 +1392,11 @@ TableVal::TableVal(IntrusivePtr<zeek::TableType> t, IntrusivePtr<zeek::detail::A
 		find_nested_record_types(t, &found);
 
 		for ( auto rt : found )
-			parse_time_table_record_dependencies[rt].emplace_back(NewRef{}, this);
+			parse_time_table_record_dependencies[rt].emplace_back(zeek::NewRef{}, this);
 		}
 	}
 
-void TableVal::Init(IntrusivePtr<zeek::TableType> t)
+void TableVal::Init(zeek::IntrusivePtr<zeek::TableType> t)
 	{
 	table_type = std::move(t);
 	expire_func = nullptr;
@@ -1459,7 +1459,7 @@ int TableVal::RecursiveSize() const
 	return n;
 	}
 
-void TableVal::SetAttrs(IntrusivePtr<zeek::detail::Attributes> a)
+void TableVal::SetAttrs(zeek::IntrusivePtr<zeek::detail::Attributes> a)
 	{
 	attrs = std::move(a);
 
@@ -1507,7 +1507,7 @@ void TableVal::CheckExpireAttr(zeek::detail::AttrTag at)
 		}
 	}
 
-bool TableVal::Assign(IntrusivePtr<Val> index, IntrusivePtr<Val> new_val)
+bool TableVal::Assign(zeek::IntrusivePtr<Val> index, zeek::IntrusivePtr<Val> new_val)
 	{
 	auto k = MakeHashKey(*index);
 
@@ -1522,11 +1522,11 @@ bool TableVal::Assign(IntrusivePtr<Val> index, IntrusivePtr<Val> new_val)
 
 bool TableVal::Assign(Val* index, Val* new_val)
 	{
-	return Assign({NewRef{}, index}, {AdoptRef{}, new_val});
+	return Assign({zeek::NewRef{}, index}, {zeek::AdoptRef{}, new_val});
 	}
 
-bool TableVal::Assign(IntrusivePtr<Val> index, std::unique_ptr<HashKey> k,
-                      IntrusivePtr<Val> new_val)
+bool TableVal::Assign(zeek::IntrusivePtr<Val> index, std::unique_ptr<HashKey> k,
+                      zeek::IntrusivePtr<Val> new_val)
 	{
 	bool is_set = table_type->IsSet();
 
@@ -1573,10 +1573,10 @@ bool TableVal::Assign(IntrusivePtr<Val> index, std::unique_ptr<HashKey> k,
 
 bool TableVal::Assign(Val* index, HashKey* k, Val* new_val)
 	{
-	return Assign({NewRef{}, index}, std::unique_ptr<HashKey>{k}, {AdoptRef{}, new_val});
+	return Assign({zeek::NewRef{}, index}, std::unique_ptr<HashKey>{k}, {zeek::AdoptRef{}, new_val});
 	}
 
-IntrusivePtr<Val> TableVal::SizeVal() const
+zeek::IntrusivePtr<Val> TableVal::SizeVal() const
 	{
 	return val_mgr->Count(Size());
 	}
@@ -1668,9 +1668,9 @@ bool TableVal::RemoveFrom(Val* val) const
 	return true;
 	}
 
-IntrusivePtr<TableVal> TableVal::Intersection(const TableVal& tv) const
+zeek::IntrusivePtr<TableVal> TableVal::Intersection(const TableVal& tv) const
 	{
-	auto result = make_intrusive<TableVal>(table_type);
+	auto result = zeek::make_intrusive<TableVal>(table_type);
 
 	const PDict<TableEntryVal>* t0 = AsTable();
 	const PDict<TableEntryVal>* t1 = tv.AsTable();
@@ -1753,7 +1753,7 @@ bool TableVal::IsSubsetOf(const TableVal& tv) const
 	return true;
 	}
 
-bool TableVal::ExpandAndInit(IntrusivePtr<Val> index, IntrusivePtr<Val> new_val)
+bool TableVal::ExpandAndInit(zeek::IntrusivePtr<Val> index, zeek::IntrusivePtr<Val> new_val)
 	{
 	const auto& index_type = index->GetType();
 
@@ -1805,7 +1805,7 @@ bool TableVal::ExpandAndInit(IntrusivePtr<Val> index, IntrusivePtr<Val> new_val)
 	}
 
 
-IntrusivePtr<Val> TableVal::Default(const IntrusivePtr<Val>& index)
+zeek::IntrusivePtr<Val> TableVal::Default(const zeek::IntrusivePtr<Val>& index)
 	{
 	const auto& def_attr = GetAttr(zeek::detail::ATTR_DEFAULT);
 
@@ -1822,8 +1822,8 @@ IntrusivePtr<Val> TableVal::Default(const IntrusivePtr<Val>& index)
 		     record_promotion_compatible(dtype->AsRecordType(),
 						 ytype->AsRecordType()) )
 			{
-			auto rt = cast_intrusive<zeek::RecordType>(ytype);
-			auto coerce = make_intrusive<zeek::detail::RecordCoerceExpr>(
+			auto rt = zeek::cast_intrusive<zeek::RecordType>(ytype);
+			auto coerce = zeek::make_intrusive<zeek::detail::RecordCoerceExpr>(
 				def_attr->GetExpr(), std::move(rt));
 
 			def_val = coerce->Eval(nullptr);
@@ -1870,7 +1870,7 @@ IntrusivePtr<Val> TableVal::Default(const IntrusivePtr<Val>& index)
 	else
 		vl.emplace_back(index);
 
-	IntrusivePtr<Val> result;
+	zeek::IntrusivePtr<Val> result;
 
 	try
 		{
@@ -1889,7 +1889,7 @@ IntrusivePtr<Val> TableVal::Default(const IntrusivePtr<Val>& index)
 	return result;
 	}
 
-const IntrusivePtr<Val>& TableVal::Find(const IntrusivePtr<Val>& index)
+const zeek::IntrusivePtr<Val>& TableVal::Find(const zeek::IntrusivePtr<Val>& index)
 	{
 	if ( subnets )
 		{
@@ -1934,7 +1934,7 @@ const IntrusivePtr<Val>& TableVal::Find(const IntrusivePtr<Val>& index)
 	return Val::nil;
 	}
 
-IntrusivePtr<Val> TableVal::FindOrDefault(const IntrusivePtr<Val>& index)
+zeek::IntrusivePtr<Val> TableVal::FindOrDefault(const zeek::IntrusivePtr<Val>& index)
 	{
 	if ( auto rval = Find(index) )
 		return rval;
@@ -1944,9 +1944,9 @@ IntrusivePtr<Val> TableVal::FindOrDefault(const IntrusivePtr<Val>& index)
 
 Val* TableVal::Lookup(Val* index, bool use_default_val)
 	{
-	static IntrusivePtr<Val> last_default;
+	static zeek::IntrusivePtr<Val> last_default;
 	last_default = nullptr;
-	IntrusivePtr<Val> idx{NewRef{}, index};
+	zeek::IntrusivePtr<Val> idx{zeek::NewRef{}, index};
 
 	if ( const auto& rval = Find(idx) )
 		return rval.get();
@@ -1958,31 +1958,31 @@ Val* TableVal::Lookup(Val* index, bool use_default_val)
 	return last_default.get();
 	}
 
-IntrusivePtr<VectorVal> TableVal::LookupSubnets(const SubNetVal* search)
+zeek::IntrusivePtr<VectorVal> TableVal::LookupSubnets(const SubNetVal* search)
 	{
 	if ( ! subnets )
 		reporter->InternalError("LookupSubnets called on wrong table type");
 
-	auto result = make_intrusive<VectorVal>(zeek::id::find_type<zeek::VectorType>("subnet_vec"));
+	auto result = zeek::make_intrusive<VectorVal>(zeek::id::find_type<zeek::VectorType>("subnet_vec"));
 
 	auto matches = subnets->FindAll(search);
 	for ( auto element : matches )
-		result->Assign(result->Size(), make_intrusive<SubNetVal>(get<0>(element)));
+		result->Assign(result->Size(), zeek::make_intrusive<SubNetVal>(get<0>(element)));
 
 	return result;
 	}
 
-IntrusivePtr<TableVal> TableVal::LookupSubnetValues(const SubNetVal* search)
+zeek::IntrusivePtr<TableVal> TableVal::LookupSubnetValues(const SubNetVal* search)
 	{
 	if ( ! subnets )
 		reporter->InternalError("LookupSubnetValues called on wrong table type");
 
-	auto nt = make_intrusive<TableVal>(this->GetType<zeek::TableType>());
+	auto nt = zeek::make_intrusive<TableVal>(this->GetType<zeek::TableType>());
 
 	auto matches = subnets->FindAll(search);
 	for ( auto element : matches )
 		{
-		auto s = make_intrusive<SubNetVal>(get<0>(element));
+		auto s = zeek::make_intrusive<SubNetVal>(get<0>(element));
 		TableEntryVal* entry = reinterpret_cast<TableEntryVal*>(get<1>(element));
 
 		if ( entry && entry->GetVal() )
@@ -2024,13 +2024,13 @@ bool TableVal::UpdateTimestamp(Val* index)
 	return true;
 	}
 
-IntrusivePtr<ListVal> TableVal::RecreateIndex(const HashKey& k) const
+zeek::IntrusivePtr<ListVal> TableVal::RecreateIndex(const HashKey& k) const
 	{
 	return table_hash->RecoverVals(k);
 	}
 
 void TableVal::CallChangeFunc(const Val* index,
-                              const IntrusivePtr<Val>& old_value,
+                              const zeek::IntrusivePtr<Val>& old_value,
                               OnChangeType tpe)
 	{
 	if ( ! change_func || ! index || in_change_func )
@@ -2059,7 +2059,7 @@ void TableVal::CallChangeFunc(const Val* index,
 
 		zeek::Args vl;
 		vl.reserve(2 + lv->Length() + table_type->IsTable());
-		vl.emplace_back(NewRef{}, this);
+		vl.emplace_back(zeek::NewRef{}, this);
 
 		switch ( tpe )
 			{
@@ -2092,14 +2092,14 @@ void TableVal::CallChangeFunc(const Val* index,
 	in_change_func = false;
 	}
 
-IntrusivePtr<Val> TableVal::Remove(const Val& index)
+zeek::IntrusivePtr<Val> TableVal::Remove(const Val& index)
 	{
 	auto k = MakeHashKey(index);
 	TableEntryVal* v = k ? AsNonConstTable()->RemoveEntry(k.get()) : nullptr;
-	IntrusivePtr<Val> va;
+	zeek::IntrusivePtr<Val> va;
 
 	if ( v )
-		va = v->GetVal() ? v->GetVal() : IntrusivePtr{NewRef{}, this};
+		va = v->GetVal() ? v->GetVal() : zeek::IntrusivePtr{zeek::NewRef{}, this};
 
 	if ( subnets && ! subnets->Remove(&index) )
 		reporter->InternalWarning("index not in prefix table");
@@ -2114,13 +2114,13 @@ IntrusivePtr<Val> TableVal::Remove(const Val& index)
 	return va;
 	}
 
-IntrusivePtr<Val> TableVal::Remove(const HashKey& k)
+zeek::IntrusivePtr<Val> TableVal::Remove(const HashKey& k)
 	{
 	TableEntryVal* v = AsNonConstTable()->RemoveEntry(k);
-	IntrusivePtr<Val> va;
+	zeek::IntrusivePtr<Val> va;
 
 	if ( v )
-		va = v->GetVal() ? v->GetVal() : IntrusivePtr{NewRef{}, this};
+		va = v->GetVal() ? v->GetVal() : zeek::IntrusivePtr{zeek::NewRef{}, this};
 
 	if ( subnets )
 		{
@@ -2143,9 +2143,9 @@ IntrusivePtr<Val> TableVal::Remove(const HashKey& k)
 	return va;
 	}
 
-IntrusivePtr<ListVal> TableVal::ToListVal(zeek::TypeTag t) const
+zeek::IntrusivePtr<ListVal> TableVal::ToListVal(zeek::TypeTag t) const
 	{
-	auto l = make_intrusive<ListVal>(t);
+	auto l = zeek::make_intrusive<ListVal>(t);
 
 	const PDict<TableEntryVal>* tbl = AsTable();
 	IterCookie* c = tbl->InitForIteration();
@@ -2177,7 +2177,7 @@ ListVal* TableVal::ConvertToList(zeek::TypeTag t) const
 	return ToListVal().release();
 	}
 
-IntrusivePtr<ListVal> TableVal::ToPureListVal() const
+zeek::IntrusivePtr<ListVal> TableVal::ToPureListVal() const
 	{
 	const auto& tl = table_type->GetIndices()->GetTypes();
 	if ( tl.size() != 1 )
@@ -2194,7 +2194,7 @@ ListVal* TableVal::ConvertToPureList() const
 	return ToPureListVal().release();
 	}
 
-const IntrusivePtr<zeek::detail::Attr>& TableVal::GetAttr(zeek::detail::AttrTag t) const
+const zeek::IntrusivePtr<zeek::detail::Attr>& TableVal::GetAttr(zeek::detail::AttrTag t) const
 	{
 	return attrs ? attrs->Find(t) : zeek::detail::Attr::nil;
 	}
@@ -2285,17 +2285,17 @@ void TableVal::Describe(ODesc* d) const
 		}
 	}
 
-bool TableVal::ExpandCompoundAndInit(ListVal* lv, int k, IntrusivePtr<Val> new_val)
+bool TableVal::ExpandCompoundAndInit(ListVal* lv, int k, zeek::IntrusivePtr<Val> new_val)
 	{
 	Val* ind_k_v = lv->Idx(k).get();
 	auto ind_k = ind_k_v->GetType()->IsSet() ?
 	      ind_k_v->AsTableVal()->ToListVal() :
-	      IntrusivePtr<ListVal>{NewRef{}, ind_k_v->AsListVal()};
+	      zeek::IntrusivePtr<ListVal>{zeek::NewRef{}, ind_k_v->AsListVal()};
 
 	for ( int i = 0; i < ind_k->Length(); ++i )
 		{
 		const auto& ind_k_i = ind_k->Idx(i);
-		auto expd = make_intrusive<ListVal>(zeek::TYPE_ANY);
+		auto expd = zeek::make_intrusive<ListVal>(zeek::TYPE_ANY);
 
 		for ( auto j = 0; j < lv->Length(); ++j )
 			{
@@ -2314,7 +2314,7 @@ bool TableVal::ExpandCompoundAndInit(ListVal* lv, int k, IntrusivePtr<Val> new_v
 	return true;
 	}
 
-bool TableVal::CheckAndAssign(IntrusivePtr<Val> index, IntrusivePtr<Val> new_val)
+bool TableVal::CheckAndAssign(zeek::IntrusivePtr<Val> index, zeek::IntrusivePtr<Val> new_val)
 	{
 	Val* v = nullptr;
 	if ( subnets )
@@ -2397,7 +2397,7 @@ void TableVal::DoExpire(double t)
 
 		else if ( v->ExpireAccessTime() + timeout < t )
 			{
-			IntrusivePtr<ListVal> idx = nullptr;
+			zeek::IntrusivePtr<ListVal> idx = nullptr;
 
 			if ( expire_func )
 				{
@@ -2491,7 +2491,7 @@ double TableVal::GetExpireTime()
 	return -1;
 	}
 
-double TableVal::CallExpireFunc(IntrusivePtr<ListVal> idx)
+double TableVal::CallExpireFunc(zeek::IntrusivePtr<ListVal> idx)
 	{
 	if ( ! expire_func )
 		return 0;
@@ -2523,7 +2523,7 @@ double TableVal::CallExpireFunc(IntrusivePtr<ListVal> idx)
 			{
 			auto lv = idx->AsListVal();
 			vl.reserve(1 + lv->Length());
-			vl.emplace_back(NewRef{}, this);
+			vl.emplace_back(zeek::NewRef{}, this);
 
 			for ( const auto& v : lv->Vals() )
 				vl.emplace_back(v);
@@ -2531,7 +2531,7 @@ double TableVal::CallExpireFunc(IntrusivePtr<ListVal> idx)
 		else
 			{
 			vl.reserve(2);
-			vl.emplace_back(NewRef{}, this);
+			vl.emplace_back(zeek::NewRef{}, this);
 
 			ListVal* idx_list = idx->AsListVal();
 			// Flatten if only one element
@@ -2554,9 +2554,9 @@ double TableVal::CallExpireFunc(IntrusivePtr<ListVal> idx)
 	return secs;
 	}
 
-IntrusivePtr<Val> TableVal::DoClone(CloneState* state)
+zeek::IntrusivePtr<Val> TableVal::DoClone(CloneState* state)
 	{
-	auto tv = make_intrusive<TableVal>(table_type);
+	auto tv = zeek::make_intrusive<TableVal>(table_type);
 	state->NewClone(this, tv);
 
 	const PDict<TableEntryVal>* tbl = AsTable();
@@ -2688,19 +2688,19 @@ TableVal::TableRecordDependencies TableVal::parse_time_table_record_dependencies
 RecordVal::RecordTypeValMap RecordVal::parse_time_records;
 
 RecordVal::RecordVal(zeek::RecordType* t, bool init_fields)
-	: RecordVal({NewRef{}, t}, init_fields)
+	: RecordVal({zeek::NewRef{}, t}, init_fields)
 	{}
 
-RecordVal::RecordVal(IntrusivePtr<zeek::RecordType> t, bool init_fields) : Val(std::move(t))
+RecordVal::RecordVal(zeek::IntrusivePtr<zeek::RecordType> t, bool init_fields) : Val(std::move(t))
 	{
 	origin = nullptr;
 	auto rt = GetType()->AsRecordType();
 	int n = rt->NumFields();
-	auto vl = val.record_val = new std::vector<IntrusivePtr<Val>>;
+	auto vl = val.record_val = new std::vector<zeek::IntrusivePtr<Val>>;
 	vl->reserve(n);
 
 	if ( is_parsing )
-		parse_time_records[rt].emplace_back(NewRef{}, this);
+		parse_time_records[rt].emplace_back(zeek::NewRef{}, this);
 
 	if ( ! init_fields )
 		return;
@@ -2718,7 +2718,7 @@ RecordVal::RecordVal(IntrusivePtr<zeek::RecordType> t, bool init_fields) : Val(s
 		     def->GetType()->Tag() == zeek::TYPE_RECORD &&
 		     ! same_type(def->GetType(), type) )
 			{
-			auto tmp = def->AsRecordVal()->CoerceTo(cast_intrusive<zeek::RecordType>(type));
+			auto tmp = def->AsRecordVal()->CoerceTo(zeek::cast_intrusive<zeek::RecordType>(type));
 
 			if ( tmp )
 				def = std::move(tmp);
@@ -2729,14 +2729,14 @@ RecordVal::RecordVal(IntrusivePtr<zeek::RecordType> t, bool init_fields) : Val(s
 			zeek::TypeTag tag = type->Tag();
 
 			if ( tag == zeek::TYPE_RECORD )
-				def = make_intrusive<RecordVal>(cast_intrusive<zeek::RecordType>(type));
+				def = zeek::make_intrusive<RecordVal>(zeek::cast_intrusive<zeek::RecordType>(type));
 
 			else if ( tag == zeek::TYPE_TABLE )
-				def = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, type->AsTableType()},
-				                               IntrusivePtr{NewRef{}, a});
+				def = zeek::make_intrusive<TableVal>(zeek::IntrusivePtr{zeek::NewRef{}, type->AsTableType()},
+				                               zeek::IntrusivePtr{zeek::NewRef{}, a});
 
 			else if ( tag == zeek::TYPE_VECTOR )
-				def = make_intrusive<VectorVal>(cast_intrusive<zeek::VectorType>(type));
+				def = zeek::make_intrusive<VectorVal>(zeek::cast_intrusive<zeek::VectorType>(type));
 			}
 
 		vl->emplace_back(std::move(def));
@@ -2748,12 +2748,12 @@ RecordVal::~RecordVal()
 	delete AsNonConstRecord();
 	}
 
-IntrusivePtr<Val> RecordVal::SizeVal() const
+zeek::IntrusivePtr<Val> RecordVal::SizeVal() const
 	{
 	return val_mgr->Count(GetType()->AsRecordType()->NumFields());
 	}
 
-void RecordVal::Assign(int field, IntrusivePtr<Val> new_val)
+void RecordVal::Assign(int field, zeek::IntrusivePtr<Val> new_val)
 	{
 	(*AsNonConstRecord())[field] = std::move(new_val);
 	Modified();
@@ -2761,10 +2761,10 @@ void RecordVal::Assign(int field, IntrusivePtr<Val> new_val)
 
 void RecordVal::Assign(int field, Val* new_val)
 	{
-	Assign(field, {AdoptRef{}, new_val});
+	Assign(field, {zeek::AdoptRef{}, new_val});
 	}
 
-IntrusivePtr<Val> RecordVal::GetFieldOrDefault(int field) const
+zeek::IntrusivePtr<Val> RecordVal::GetFieldOrDefault(int field) const
 	{
 	const auto& val = (*AsRecord())[field];
 
@@ -2804,7 +2804,7 @@ void RecordVal::DoneParsing()
 	parse_time_records.clear();
 	}
 
-const IntrusivePtr<Val>& RecordVal::GetField(const char* field) const
+const zeek::IntrusivePtr<Val>& RecordVal::GetField(const char* field) const
 	{
 	int idx = GetType()->AsRecordType()->FieldOffset(field);
 
@@ -2814,7 +2814,7 @@ const IntrusivePtr<Val>& RecordVal::GetField(const char* field) const
 	return GetField(idx);
 	}
 
-IntrusivePtr<Val> RecordVal::GetFieldOrDefault(const char* field) const
+zeek::IntrusivePtr<Val> RecordVal::GetFieldOrDefault(const char* field) const
 	{
 	int idx = GetType()->AsRecordType()->FieldOffset(field);
 
@@ -2824,15 +2824,16 @@ IntrusivePtr<Val> RecordVal::GetFieldOrDefault(const char* field) const
 	return GetFieldOrDefault(idx);
 	}
 
-IntrusivePtr<RecordVal> RecordVal::CoerceTo(IntrusivePtr<zeek::RecordType> t,
-                                            IntrusivePtr<RecordVal> aggr,
-                                            bool allow_orphaning) const
+zeek::IntrusivePtr<RecordVal> RecordVal::CoerceTo(
+	zeek::IntrusivePtr<zeek::RecordType> t,
+	zeek::IntrusivePtr<RecordVal> aggr,
+	bool allow_orphaning) const
 	{
 	if ( ! record_promotion_compatible(t.get(), GetType()->AsRecordType()) )
 		return nullptr;
 
 	if ( ! aggr )
-		aggr = make_intrusive<RecordVal>(std::move(t));
+		aggr = zeek::make_intrusive<RecordVal>(std::move(t));
 
 	zeek::RecordType* ar_t = aggr->GetType()->AsRecordType();
 	const zeek::RecordType* rv_t = GetType()->AsRecordType();
@@ -2865,9 +2866,9 @@ IntrusivePtr<RecordVal> RecordVal::CoerceTo(IntrusivePtr<zeek::RecordType> t,
 
 		if ( ft->Tag() == zeek::TYPE_RECORD && ! same_type(ft, v->GetType()) )
 			{
-			auto rhs = make_intrusive<zeek::detail::ConstExpr>(v);
-			auto e = make_intrusive<zeek::detail::RecordCoerceExpr>(std::move(rhs),
-			                                                        cast_intrusive<zeek::RecordType>(ft));
+			auto rhs = zeek::make_intrusive<zeek::detail::ConstExpr>(v);
+			auto e = zeek::make_intrusive<zeek::detail::RecordCoerceExpr>(
+				std::move(rhs), zeek::cast_intrusive<zeek::RecordType>(ft));
 			aggr->Assign(t_i, e->Eval(nullptr));
 			continue;
 			}
@@ -2888,16 +2889,16 @@ IntrusivePtr<RecordVal> RecordVal::CoerceTo(IntrusivePtr<zeek::RecordType> t,
 	return aggr;
 	}
 
-IntrusivePtr<RecordVal> RecordVal::CoerceTo(IntrusivePtr<zeek::RecordType> t,
-                                            bool allow_orphaning)
+zeek::IntrusivePtr<RecordVal> RecordVal::CoerceTo(zeek::IntrusivePtr<zeek::RecordType> t,
+                                                  bool allow_orphaning)
 	{
 	if ( same_type(GetType(), t) )
-		return {NewRef{}, this};
+		return {zeek::NewRef{}, this};
 
 	return CoerceTo(std::move(t), nullptr, allow_orphaning);
 	}
 
-IntrusivePtr<TableVal> RecordVal::GetRecordFieldsVal() const
+zeek::IntrusivePtr<TableVal> RecordVal::GetRecordFieldsVal() const
 	{
 	return GetType()->AsRecordType()->GetRecordFieldsVal(this);
 	}
@@ -2969,14 +2970,14 @@ void RecordVal::DescribeReST(ODesc* d) const
 	d->Add("}");
 	}
 
-IntrusivePtr<Val> RecordVal::DoClone(CloneState* state)
+zeek::IntrusivePtr<Val> RecordVal::DoClone(CloneState* state)
 	{
 	// We set origin to 0 here.  Origin only seems to be used for exactly one
 	// purpose - to find the connection record that is associated with a
 	// record. As we cannot guarantee that it will ber zeroed out at the
 	// approproate time (as it seems to be guaranteed for the original record)
 	// we don't touch it.
-	auto rv = make_intrusive<RecordVal>(GetType<zeek::RecordType>(), false);
+	auto rv = zeek::make_intrusive<RecordVal>(GetType<zeek::RecordType>(), false);
 	rv->origin = nullptr;
 	state->NewClone(this, rv);
 
@@ -3000,12 +3001,12 @@ unsigned int RecordVal::MemoryAllocation() const
 		    size += v->MemoryAllocation();
 		}
 
-	size += pad_size(vl.capacity() * sizeof(IntrusivePtr<Val>));
+	size += pad_size(vl.capacity() * sizeof(zeek::IntrusivePtr<Val>));
 	size += padded_sizeof(vl);
 	return size + padded_sizeof(*this);
 	}
 
-IntrusivePtr<Val> EnumVal::SizeVal() const
+zeek::IntrusivePtr<Val> EnumVal::SizeVal() const
 	{
 	return val_mgr->Int(val.int_val);
 	}
@@ -3020,18 +3021,18 @@ void EnumVal::ValDescribe(ODesc* d) const
 	d->Add(ename);
 	}
 
-IntrusivePtr<Val> EnumVal::DoClone(CloneState* state)
+zeek::IntrusivePtr<Val> EnumVal::DoClone(CloneState* state)
 	{
 	// Immutable.
-	return {NewRef{}, this};
+	return {zeek::NewRef{}, this};
 	}
 
-VectorVal::VectorVal(zeek::VectorType* t) : VectorVal({NewRef{}, t})
+VectorVal::VectorVal(zeek::VectorType* t) : VectorVal({zeek::NewRef{}, t})
 	{ }
 
-VectorVal::VectorVal(IntrusivePtr<zeek::VectorType> t) : Val(std::move(t))
+VectorVal::VectorVal(zeek::IntrusivePtr<zeek::VectorType> t) : Val(std::move(t))
 	{
-	val.vector_val = new vector<IntrusivePtr<Val>>();
+	val.vector_val = new vector<zeek::IntrusivePtr<Val>>();
 	}
 
 VectorVal::~VectorVal()
@@ -3039,12 +3040,12 @@ VectorVal::~VectorVal()
 	delete val.vector_val;
 	}
 
-IntrusivePtr<Val> VectorVal::SizeVal() const
+zeek::IntrusivePtr<Val> VectorVal::SizeVal() const
 	{
 	return val_mgr->Count(uint32_t(val.vector_val->size()));
 	}
 
-bool VectorVal::Assign(unsigned int index, IntrusivePtr<Val> element)
+bool VectorVal::Assign(unsigned int index, zeek::IntrusivePtr<Val> element)
 	{
 	if ( element &&
 	     ! same_type(element->GetType(), GetType()->AsVectorType()->Yield(), false) )
@@ -3060,7 +3061,7 @@ bool VectorVal::Assign(unsigned int index, IntrusivePtr<Val> element)
 	}
 
 bool VectorVal::AssignRepeat(unsigned int index, unsigned int how_many,
-                             IntrusivePtr<Val> element)
+                             zeek::IntrusivePtr<Val> element)
 	{
 	ResizeAtLeast(index + how_many);
 
@@ -3071,7 +3072,7 @@ bool VectorVal::AssignRepeat(unsigned int index, unsigned int how_many,
 	return true;
 	}
 
-bool VectorVal::Insert(unsigned int index, IntrusivePtr<Val> element)
+bool VectorVal::Insert(unsigned int index, zeek::IntrusivePtr<Val> element)
 	{
 	if ( element &&
 	     ! same_type(element->GetType(), GetType()->AsVectorType()->Yield(), false) )
@@ -3079,7 +3080,7 @@ bool VectorVal::Insert(unsigned int index, IntrusivePtr<Val> element)
 		return false;
 		}
 
-	vector<IntrusivePtr<Val>>::iterator it;
+	vector<zeek::IntrusivePtr<Val>>::iterator it;
 
 	if ( index < val.vector_val->size() )
 		it = std::next(val.vector_val->begin(), index);
@@ -3128,7 +3129,7 @@ bool VectorVal::AddTo(Val* val, bool /* is_first_init */) const
 	return true;
 	}
 
-const IntrusivePtr<Val>& VectorVal::At(unsigned int index) const
+const zeek::IntrusivePtr<Val>& VectorVal::At(unsigned int index) const
 	{
 	if ( index >= val.vector_val->size() )
 		return Val::nil;
@@ -3153,9 +3154,9 @@ unsigned int VectorVal::ResizeAtLeast(unsigned int new_num_elements)
 	 return Resize(new_num_elements);
 	 }
 
-IntrusivePtr<Val> VectorVal::DoClone(CloneState* state)
+zeek::IntrusivePtr<Val> VectorVal::DoClone(CloneState* state)
 	{
-	auto vv = make_intrusive<VectorVal>(GetType<zeek::VectorType>());
+	auto vv = zeek::make_intrusive<VectorVal>(GetType<zeek::VectorType>());
 	vv->val.vector_val->reserve(val.vector_val->size());
 	state->NewClone(this, vv);
 
@@ -3187,9 +3188,10 @@ void VectorVal::ValDescribe(ODesc* d) const
 	d->Add("]");
 	}
 
-IntrusivePtr<Val> check_and_promote(IntrusivePtr<Val> v, const zeek::Type* t,
-                                    bool is_init,
-                                    const Location* expr_location)
+zeek::IntrusivePtr<Val> check_and_promote(zeek::IntrusivePtr<Val> v,
+                                          const zeek::Type* t,
+                                          bool is_init,
+                                          const Location* expr_location)
 	{
 	if ( ! v )
 		return nullptr;
@@ -3246,7 +3248,7 @@ IntrusivePtr<Val> check_and_promote(IntrusivePtr<Val> v, const zeek::Type* t,
 		// Already has the right internal type.
 		return v;
 
-	IntrusivePtr<Val> promoted_v;
+	zeek::IntrusivePtr<Val> promoted_v;
 
 	switch ( it ) {
 	case zeek::TYPE_INTERNAL_INT:
@@ -3284,13 +3286,13 @@ IntrusivePtr<Val> check_and_promote(IntrusivePtr<Val> v, const zeek::Type* t,
 	case zeek::TYPE_INTERNAL_DOUBLE:
 		switch ( t_tag ) {
 		case zeek::TYPE_DOUBLE:
-			promoted_v = make_intrusive<DoubleVal>(v->CoerceToDouble());
+			promoted_v = zeek::make_intrusive<DoubleVal>(v->CoerceToDouble());
 			break;
 		case zeek::TYPE_INTERVAL:
-			promoted_v = make_intrusive<IntervalVal>(v->CoerceToDouble());
+			promoted_v = zeek::make_intrusive<IntervalVal>(v->CoerceToDouble());
 			break;
 		case zeek::TYPE_TIME:
-			promoted_v = make_intrusive<TimeVal>(v->CoerceToDouble());
+			promoted_v = zeek::make_intrusive<TimeVal>(v->CoerceToDouble());
 			break;
 		default:
 			reporter->InternalError("bad internal type in check_and_promote()");
@@ -3363,7 +3365,7 @@ void describe_vals(const val_list* vals, ODesc* d, int offset)
 		}
 	}
 
-void describe_vals(const std::vector<IntrusivePtr<Val>>& vals,
+void describe_vals(const std::vector<zeek::IntrusivePtr<Val>>& vals,
                    ODesc* d, size_t offset)
 	{
 	if ( ! d->IsReadable() )
@@ -3391,7 +3393,7 @@ void delete_vals(val_list* vals)
 		}
 	}
 
-IntrusivePtr<Val> cast_value_to_type(Val* v, zeek::Type* t)
+zeek::IntrusivePtr<Val> cast_value_to_type(Val* v, zeek::Type* t)
 	{
 	// Note: when changing this function, adapt all three of
 	// cast_value_to_type()/can_cast_value_to_type()/can_cast_value_to_type().
@@ -3402,7 +3404,7 @@ IntrusivePtr<Val> cast_value_to_type(Val* v, zeek::Type* t)
 	// Always allow casting to same type. This also covers casting 'any'
 	// to the actual type.
 	if ( same_type(v->GetType(), t) )
-		return {NewRef{}, v};
+		return {zeek::NewRef{}, v};
 
 	if ( same_type(v->GetType(), bro_broker::DataVal::ScriptDataType()) )
 		{
@@ -3462,24 +3464,24 @@ bool can_cast_value_to_type(const zeek::Type* s, zeek::Type* t)
 	return false;
 	}
 
-IntrusivePtr<Val> Val::MakeBool(bool b)
+zeek::IntrusivePtr<Val> Val::MakeBool(bool b)
 	{
-	return IntrusivePtr{AdoptRef{}, new Val(bro_int_t(b), zeek::TYPE_BOOL)};
+	return zeek::IntrusivePtr{zeek::AdoptRef{}, new Val(bro_int_t(b), zeek::TYPE_BOOL)};
 	}
 
-IntrusivePtr<Val> Val::MakeInt(bro_int_t i)
+zeek::IntrusivePtr<Val> Val::MakeInt(bro_int_t i)
 	{
-	return IntrusivePtr{AdoptRef{}, new Val(i, zeek::TYPE_INT)};
+	return zeek::IntrusivePtr{zeek::AdoptRef{}, new Val(i, zeek::TYPE_INT)};
 	}
 
-IntrusivePtr<Val> Val::MakeCount(bro_uint_t u)
+zeek::IntrusivePtr<Val> Val::MakeCount(bro_uint_t u)
 	{
-	return IntrusivePtr{AdoptRef{}, new Val(u, zeek::TYPE_COUNT)};
+	return zeek::IntrusivePtr{zeek::AdoptRef{}, new Val(u, zeek::TYPE_COUNT)};
 	}
 
 ValManager::ValManager()
 	{
-	empty_string = make_intrusive<StringVal>("");
+	empty_string = zeek::make_intrusive<StringVal>("");
 	b_false = Val::MakeBool(false);
 	b_true = Val::MakeBool(true);
 
@@ -3495,7 +3497,7 @@ ValManager::ValManager()
 		auto port_type = (TransportProto)i;
 
 		for ( auto j = 0u; j < arr.size(); ++j )
-			arr[j] = IntrusivePtr{AdoptRef{}, new PortVal(PortVal::Mask(j, port_type))};
+			arr[j] = zeek::IntrusivePtr{zeek::AdoptRef{}, new PortVal(PortVal::Mask(j, port_type))};
 		}
 	}
 
@@ -3504,7 +3506,7 @@ StringVal* ValManager::GetEmptyString() const
 	return empty_string->Ref()->AsStringVal();
 	}
 
-const IntrusivePtr<PortVal>& ValManager::Port(uint32_t port_num, TransportProto port_type) const
+const zeek::IntrusivePtr<PortVal>& ValManager::Port(uint32_t port_num, TransportProto port_type) const
 	{
 	if ( port_num >= 65536 )
 		{
@@ -3520,7 +3522,7 @@ PortVal* ValManager::GetPort(uint32_t port_num, TransportProto port_type) const
 	return Port(port_num, port_type)->Ref()->AsPortVal();
 	}
 
-const IntrusivePtr<PortVal>& ValManager::Port(uint32_t port_num) const
+const zeek::IntrusivePtr<PortVal>& ValManager::Port(uint32_t port_num) const
 	{
 	auto mask = port_num & PORT_SPACE_MASK;
 	port_num &= ~PORT_SPACE_MASK;
diff --git a/src/Val.h b/src/Val.h
index d57746103f..55b9b0cf95 100644
--- a/src/Val.h
+++ b/src/Val.h
@@ -28,17 +28,16 @@
 template<typename T> class PDict;
 class IterCookie;
 
-class Val;
 class BroString;
 class BroFunc;
 class Func;
 class BroFile;
 class PrefixTable;
 
+class Val;
 class PortVal;
 class AddrVal;
 class SubNetVal;
-
 class IntervalVal;
 class PatternVal;
 class TableVal;
@@ -47,16 +46,14 @@ class ListVal;
 class StringVal;
 class EnumVal;
 class OpaqueVal;
+class VectorVal;
+class TableEntryVal;
 
 class IPAddr;
 class IPPrefix;
 
 class StateAccess;
 
-class VectorVal;
-
-class TableEntryVal;
-
 class RE_Matcher;
 
 union BroValUnion {
@@ -80,8 +77,8 @@ union BroValUnion {
 	BroFile* file_val;
 	RE_Matcher* re_val;
 	PDict<TableEntryVal>* table_val;
-	std::vector<IntrusivePtr<Val>>* record_val;
-	std::vector<IntrusivePtr<Val>>* vector_val;
+	std::vector<zeek::IntrusivePtr<Val>>* record_val;
+	std::vector<zeek::IntrusivePtr<Val>>* vector_val;
 
 	BroValUnion() = default;
 
@@ -118,7 +115,7 @@ union BroValUnion {
 
 class Val : public BroObj {
 public:
-	static inline const IntrusivePtr<Val> nil;
+	static inline const zeek::IntrusivePtr<Val> nil;
 
 	[[deprecated("Remove in v4.1.  Use IntervalVal(), TimeVal(), or DoubleVal() constructors.")]]
 	Val(double d, zeek::TypeTag t)
@@ -127,21 +124,21 @@ public:
 
 	[[deprecated("Remove in v4.1.  Construct from IntrusivePtr instead.")]]
 	explicit Val(Func* f);
-	explicit Val(IntrusivePtr<Func> f);
+	explicit Val(zeek::IntrusivePtr<Func> f);
 
 	[[deprecated("Remove in v4.1.  Construct from IntrusivePtr instead.")]]
 	explicit Val(BroFile* f);
 	// Note, the file will be closed after this Val is destructed if there's
 	// no other remaining references.
-	explicit Val(IntrusivePtr<BroFile> f);
+	explicit Val(zeek::IntrusivePtr<BroFile> f);
 
 	// Extra arg to differentiate from protected version.
-	Val(IntrusivePtr<zeek::Type> t, bool type_type)
-		: type(make_intrusive<zeek::TypeType>(std::move(t)))
+	Val(zeek::IntrusivePtr<zeek::Type> t, bool type_type)
+		: type(zeek::make_intrusive<zeek::TypeType>(std::move(t)))
 		{}
 
 	[[deprecated("Remove in v4.1.  Construct from IntrusivePtr instead.")]]
-	Val(zeek::Type* t, bool type_type) : Val({NewRef{}, t}, type_type)
+	Val(zeek::Type* t, bool type_type) : Val({zeek::NewRef{}, t}, type_type)
 		{}
 
 	Val()
@@ -151,7 +148,7 @@ public:
 	~Val() override;
 
 	Val* Ref()			{ ::Ref(this); return this; }
-	IntrusivePtr<Val> Clone();
+	zeek::IntrusivePtr<Val> Clone();
 
 	bool IsZero() const;
 	bool IsOne() const;
@@ -166,7 +163,7 @@ public:
 
 	// Returns a new Val with the "size" of this Val.  What constitutes
 	// size depends on the Val's type.
-	virtual IntrusivePtr<Val> SizeVal() const;
+	virtual zeek::IntrusivePtr<Val> SizeVal() const;
 
 	// Bytes in total value object.
 	virtual unsigned int MemoryAllocation() const;
@@ -185,12 +182,12 @@ public:
 	[[deprecated("Remove in v4.1.  Use GetType().")]]
 	const zeek::Type* Type() const	{ return type.get(); }
 
-	const IntrusivePtr<zeek::Type>& GetType() const
+	const zeek::IntrusivePtr<zeek::Type>& GetType() const
 		{ return type; }
 
 	template <class T>
-	IntrusivePtr<T> GetType() const
-		{ return cast_intrusive<T>(type); }
+	zeek::IntrusivePtr<T> GetType() const
+		{ return zeek::cast_intrusive<T>(type); }
 
 #define CONST_ACCESSOR(tag, ctype, accessor, name) \
 	const ctype name() const \
@@ -218,10 +215,10 @@ public:
 	CONST_ACCESSOR(zeek::TYPE_STRING, BroString*, string_val, AsString)
 	CONST_ACCESSOR(zeek::TYPE_FUNC, Func*, func_val, AsFunc)
 	CONST_ACCESSOR(zeek::TYPE_TABLE, PDict<TableEntryVal>*, table_val, AsTable)
-	CONST_ACCESSOR(zeek::TYPE_RECORD, std::vector<IntrusivePtr<Val>>*, record_val, AsRecord)
+	CONST_ACCESSOR(zeek::TYPE_RECORD, std::vector<zeek::IntrusivePtr<Val>>*, record_val, AsRecord)
 	CONST_ACCESSOR(zeek::TYPE_FILE, BroFile*, file_val, AsFile)
 	CONST_ACCESSOR(zeek::TYPE_PATTERN, RE_Matcher*, re_val, AsPattern)
-	CONST_ACCESSOR(zeek::TYPE_VECTOR, std::vector<IntrusivePtr<Val>>*, vector_val, AsVector)
+	CONST_ACCESSOR(zeek::TYPE_VECTOR, std::vector<zeek::IntrusivePtr<Val>>*, vector_val, AsVector)
 
 	const IPPrefix& AsSubNet() const
 		{
@@ -255,9 +252,9 @@ public:
 	ACCESSOR(zeek::TYPE_FUNC, Func*, func_val, AsFunc)
 	ACCESSOR(zeek::TYPE_FILE, BroFile*, file_val, AsFile)
 	ACCESSOR(zeek::TYPE_PATTERN, RE_Matcher*, re_val, AsPattern)
-	ACCESSOR(zeek::TYPE_VECTOR, std::vector<IntrusivePtr<Val>>*, vector_val, AsVector)
+	ACCESSOR(zeek::TYPE_VECTOR, std::vector<zeek::IntrusivePtr<Val>>*, vector_val, AsVector)
 
-	IntrusivePtr<Func> AsFuncPtr() const;
+	zeek::IntrusivePtr<Func> AsFuncPtr() const;
 
 	const IPPrefix& AsSubNet()
 		{
@@ -331,9 +328,9 @@ public:
 
 	static bool WouldOverflow(const zeek::Type* from_type, const zeek::Type* to_type, const Val* val);
 
-	IntrusivePtr<TableVal> GetRecordFields();
+	zeek::IntrusivePtr<TableVal> GetRecordFields();
 
-	IntrusivePtr<StringVal> ToJSON(bool only_loggable=false, RE_Matcher* re=nullptr);
+	zeek::IntrusivePtr<StringVal> ToJSON(bool only_loggable=false, RE_Matcher* re=nullptr);
 
 protected:
 
@@ -347,9 +344,9 @@ protected:
 	virtual void ValDescribe(ODesc* d) const;
 	virtual void ValDescribeReST(ODesc* d) const;
 
-	static IntrusivePtr<Val> MakeBool(bool b);
-	static IntrusivePtr<Val> MakeInt(bro_int_t i);
-	static IntrusivePtr<Val> MakeCount(bro_uint_t u);
+	static zeek::IntrusivePtr<Val> MakeBool(bool b);
+	static zeek::IntrusivePtr<Val> MakeInt(bro_int_t i);
+	static zeek::IntrusivePtr<Val> MakeCount(bro_uint_t u);
 
 	template<typename V>
 	Val(V&& v, zeek::TypeTag t) noexcept
@@ -357,32 +354,32 @@ protected:
 		{}
 
 	template<typename V>
-	Val(V&& v, IntrusivePtr<zeek::Type> t) noexcept
+	Val(V&& v, zeek::IntrusivePtr<zeek::Type> t) noexcept
 		: val(std::forward<V>(v)), type(std::move(t))
 		{}
 
-	explicit Val(IntrusivePtr<zeek::Type> t) noexcept
+	explicit Val(zeek::IntrusivePtr<zeek::Type> t) noexcept
 		: type(std::move(t))
 		{}
 
 	ACCESSOR(zeek::TYPE_TABLE, PDict<TableEntryVal>*, table_val, AsNonConstTable)
-	ACCESSOR(zeek::TYPE_RECORD, std::vector<IntrusivePtr<Val>>*, record_val, AsNonConstRecord)
+	ACCESSOR(zeek::TYPE_RECORD, std::vector<zeek::IntrusivePtr<Val>>*, record_val, AsNonConstRecord)
 
 	// For internal use by the Val::Clone() methods.
 	struct CloneState {
 		// Caches a cloned value for later reuse during the same
 		// cloning operation. For recursive types, call this *before*
 		// descending down.
-		IntrusivePtr<Val> NewClone(Val* src, IntrusivePtr<Val> dst);
+		zeek::IntrusivePtr<Val> NewClone(Val* src, zeek::IntrusivePtr<Val> dst);
 
 		std::unordered_map<Val*, Val*> clones;
 	};
 
-	IntrusivePtr<Val> Clone(CloneState* state);
-	virtual IntrusivePtr<Val> DoClone(CloneState* state);
+	zeek::IntrusivePtr<Val> Clone(CloneState* state);
+	virtual zeek::IntrusivePtr<Val> DoClone(CloneState* state);
 
 	BroValUnion val;
-	IntrusivePtr<zeek::Type> type;
+	zeek::IntrusivePtr<zeek::Type> type;
 
 #ifdef DEBUG
 	// For debugging, we keep the name of the ID to which a Val is bound.
@@ -408,21 +405,21 @@ public:
 	inline Val* GetTrue() const
 		{ return b_true->Ref(); }
 
-	inline const IntrusivePtr<Val>& True() const
+	inline const zeek::IntrusivePtr<Val>& True() const
 		{ return b_true; }
 
 	[[deprecated("Remove in v4.1.  Use val_mgr->False() instead.")]]
 	inline Val* GetFalse() const
 		{ return b_false->Ref(); }
 
-	inline const IntrusivePtr<Val>& False() const
+	inline const zeek::IntrusivePtr<Val>& False() const
 		{ return b_false; }
 
 	[[deprecated("Remove in v4.1.  Use val_mgr->Bool() instead.")]]
 	inline Val* GetBool(bool b) const
 		{ return b ? b_true->Ref() : b_false->Ref(); }
 
-	inline const IntrusivePtr<Val>& Bool(bool b) const
+	inline const zeek::IntrusivePtr<Val>& Bool(bool b) const
 		{ return b ? b_true : b_false; }
 
 	[[deprecated("Remove in v4.1.  Use val_mgr->Int() instead.")]]
@@ -432,7 +429,7 @@ public:
 		    Val::MakeInt(i).release() : ints[i - PREALLOCATED_INT_LOWEST]->Ref();
 		}
 
-	inline IntrusivePtr<Val> Int(int64_t i) const
+	inline zeek::IntrusivePtr<Val> Int(int64_t i) const
 		{
 		return i < PREALLOCATED_INT_LOWEST || i > PREALLOCATED_INT_HIGHEST ?
 		    Val::MakeInt(i) : ints[i - PREALLOCATED_INT_LOWEST];
@@ -444,7 +441,7 @@ public:
 		return i >= PREALLOCATED_COUNTS ? Val::MakeCount(i).release() : counts[i]->Ref();
 		}
 
-	inline IntrusivePtr<Val> Count(uint64_t i) const
+	inline zeek::IntrusivePtr<Val> Count(uint64_t i) const
 		{
 		return i >= PREALLOCATED_COUNTS ? Val::MakeCount(i) : counts[i];
 		}
@@ -452,7 +449,7 @@ public:
 	[[deprecated("Remove in v4.1.  Use val_mgr->EmptyString() instead.")]]
 	StringVal* GetEmptyString() const;
 
-	inline const IntrusivePtr<StringVal>& EmptyString() const
+	inline const zeek::IntrusivePtr<StringVal>& EmptyString() const
 		{ return empty_string; }
 
 	// Port number given in host order.
@@ -460,23 +457,23 @@ public:
 	PortVal* GetPort(uint32_t port_num, TransportProto port_type) const;
 
 	// Port number given in host order.
-	const IntrusivePtr<PortVal>& Port(uint32_t port_num, TransportProto port_type) const;
+	const zeek::IntrusivePtr<PortVal>& Port(uint32_t port_num, TransportProto port_type) const;
 
 	// Host-order port number already masked with port space protocol mask.
 	[[deprecated("Remove in v4.1.  Use val_mgr->Port() instead.")]]
 	PortVal* GetPort(uint32_t port_num) const;
 
 	// Host-order port number already masked with port space protocol mask.
-	const IntrusivePtr<PortVal>& Port(uint32_t port_num) const;
+	const zeek::IntrusivePtr<PortVal>& Port(uint32_t port_num) const;
 
 private:
 
-	std::array<std::array<IntrusivePtr<PortVal>, 65536>, NUM_PORT_SPACES> ports;
-	std::array<IntrusivePtr<Val>, PREALLOCATED_COUNTS> counts;
-	std::array<IntrusivePtr<Val>, PREALLOCATED_INTS> ints;
-	IntrusivePtr<StringVal> empty_string;
-	IntrusivePtr<Val> b_true;
-	IntrusivePtr<Val> b_false;
+	std::array<std::array<zeek::IntrusivePtr<PortVal>, 65536>, NUM_PORT_SPACES> ports;
+	std::array<zeek::IntrusivePtr<Val>, PREALLOCATED_COUNTS> counts;
+	std::array<zeek::IntrusivePtr<Val>, PREALLOCATED_INTS> ints;
+	zeek::IntrusivePtr<StringVal> empty_string;
+	zeek::IntrusivePtr<Val> b_true;
+	zeek::IntrusivePtr<Val> b_false;
 };
 
 extern ValManager* val_mgr;
@@ -514,7 +511,7 @@ public:
 
 class PortVal final : public Val {
 public:
-	IntrusivePtr<Val> SizeVal() const override;
+	zeek::IntrusivePtr<Val> SizeVal() const override;
 
 	// Returns the port number in host order (not including the mask).
 	uint32_t Port() const;
@@ -545,7 +542,7 @@ protected:
 	PortVal(uint32_t p);
 
 	void ValDescribe(ODesc* d) const override;
-	IntrusivePtr<Val> DoClone(CloneState* state) override;
+	zeek::IntrusivePtr<Val> DoClone(CloneState* state) override;
 };
 
 class AddrVal final : public Val {
@@ -554,7 +551,7 @@ public:
 	explicit AddrVal(const std::string& text);
 	~AddrVal() override;
 
-	IntrusivePtr<Val> SizeVal() const override;
+	zeek::IntrusivePtr<Val> SizeVal() const override;
 
 	// Constructor for address already in network order.
 	explicit AddrVal(uint32_t addr);          // IPv4.
@@ -564,7 +561,7 @@ public:
 	unsigned int MemoryAllocation() const override;
 
 protected:
-	IntrusivePtr<Val> DoClone(CloneState* state) override;
+	zeek::IntrusivePtr<Val> DoClone(CloneState* state) override;
 };
 
 class SubNetVal final : public Val {
@@ -577,7 +574,7 @@ public:
 	explicit SubNetVal(const IPPrefix& prefix);
 	~SubNetVal() override;
 
-	IntrusivePtr<Val> SizeVal() const override;
+	zeek::IntrusivePtr<Val> SizeVal() const override;
 
 	const IPAddr& Prefix() const;
 	int Width() const;
@@ -589,7 +586,7 @@ public:
 
 protected:
 	void ValDescribe(ODesc* d) const override;
-	IntrusivePtr<Val> DoClone(CloneState* state) override;
+	zeek::IntrusivePtr<Val> DoClone(CloneState* state) override;
 };
 
 class StringVal final : public Val {
@@ -599,7 +596,7 @@ public:
 	explicit StringVal(const std::string& s);
 	StringVal(int length, const char* s);
 
-	IntrusivePtr<Val> SizeVal() const override;
+	zeek::IntrusivePtr<Val> SizeVal() const override;
 
 	int Len();
 	const u_char* Bytes();
@@ -615,8 +612,8 @@ public:
 
 	unsigned int MemoryAllocation() const override;
 
-	IntrusivePtr<StringVal> Replace(RE_Matcher* re, const BroString& repl,
-	                                bool do_all);
+	zeek::IntrusivePtr<StringVal> Replace(RE_Matcher* re, const BroString& repl,
+	                                      bool do_all);
 
 	[[deprecated("Remove in v4.1.  Use Replace().")]]
 	Val* Substitute(RE_Matcher* re, StringVal* repl, bool do_all)
@@ -624,7 +621,7 @@ public:
 
 protected:
 	void ValDescribe(ODesc* d) const override;
-	IntrusivePtr<Val> DoClone(CloneState* state) override;
+	zeek::IntrusivePtr<Val> DoClone(CloneState* state) override;
 };
 
 class PatternVal final : public Val {
@@ -640,7 +637,7 @@ public:
 
 protected:
 	void ValDescribe(ODesc* d) const override;
-	IntrusivePtr<Val> DoClone(CloneState* state) override;
+	zeek::IntrusivePtr<Val> DoClone(CloneState* state) override;
 };
 
 // ListVals are mainly used to index tables that have more than one
@@ -653,11 +650,11 @@ public:
 
 	zeek::TypeTag BaseTag() const		{ return tag; }
 
-	IntrusivePtr<Val> SizeVal() const override;
+	zeek::IntrusivePtr<Val> SizeVal() const override;
 
 	int Length() const		{ return vals.size(); }
 
-	const IntrusivePtr<Val>& Idx(size_t i) const	{ return vals[i]; }
+	const zeek::IntrusivePtr<Val>& Idx(size_t i) const	{ return vals[i]; }
 
 	[[deprecated("Remove in v4.1.  Use Idx() instead")]]
 	Val* Index(const int n)		{ return vals[n].get(); }
@@ -678,27 +675,27 @@ public:
 	 * Appends a value to the list.
 	 * @param v  the value to append.
 	 */
-	void Append(IntrusivePtr<Val> v);
+	void Append(zeek::IntrusivePtr<Val> v);
 
 	[[deprecated("Remove in v4.1.  Use Append(IntrusivePtr) instead.")]]
 	void Append(Val* v);
 
 	// Returns a Set representation of the list (which must be homogeneous).
-	IntrusivePtr<TableVal> ToSetVal() const;
+	zeek::IntrusivePtr<TableVal> ToSetVal() const;
 
 	[[deprecated("Remove in v4.1.  Use ToSetVal() instead.")]]
 	TableVal* ConvertToSet() const;
 
-	const std::vector<IntrusivePtr<Val>>& Vals() const	{ return vals; }
+	const std::vector<zeek::IntrusivePtr<Val>>& Vals() const	{ return vals; }
 
 	void Describe(ODesc* d) const override;
 
 	unsigned int MemoryAllocation() const override;
 
 protected:
-	IntrusivePtr<Val> DoClone(CloneState* state) override;
+	zeek::IntrusivePtr<Val> DoClone(CloneState* state) override;
 
-	std::vector<IntrusivePtr<Val>> vals;
+	std::vector<zeek::IntrusivePtr<Val>> vals;
 	zeek::TypeTag tag;
 };
 
@@ -706,7 +703,7 @@ extern double bro_start_network_time;
 
 class TableEntryVal {
 public:
-	explicit TableEntryVal(IntrusivePtr<Val> v)
+	explicit TableEntryVal(zeek::IntrusivePtr<Val> v)
 		: val(std::move(v))
 		{
 		expire_access_time =
@@ -718,7 +715,7 @@ public:
 	[[deprecated("Remove in v4.1.  Use GetVal().")]]
 	Val* Value()	{ return val.get(); }
 
-	const IntrusivePtr<Val>& GetVal() const
+	const zeek::IntrusivePtr<Val>& GetVal() const
 		{ return val; }
 
 	// Returns/sets time of last expiration relevant access to this value.
@@ -730,7 +727,8 @@ public:
 protected:
 	friend class TableVal;
 
-	IntrusivePtr<Val> val;
+	zeek::IntrusivePtr<Val> val;
+
 	// The next entry stores seconds since Bro's start.  We use ints here
 	// to save a few bytes, as we do not need a high resolution for these
 	// anyway.
@@ -756,11 +754,11 @@ class Frame;
 
 class TableVal final : public Val, public notifier::Modifiable {
 public:
-	explicit TableVal(IntrusivePtr<zeek::TableType> t, IntrusivePtr<zeek::detail::Attributes> attrs = nullptr);
+	explicit TableVal(zeek::IntrusivePtr<zeek::TableType> t, zeek::IntrusivePtr<zeek::detail::Attributes> attrs = nullptr);
 
 	[[deprecated("Remove in v4.1.  Construct from IntrusivePtrs instead.")]]
 	explicit TableVal(zeek::TableType* t, zeek::detail::Attributes* attrs = nullptr)
-		: TableVal({NewRef{}, t}, {NewRef{}, attrs})
+		: TableVal({zeek::NewRef{}, t}, {zeek::NewRef{}, attrs})
 		{}
 
 	~TableVal() override;
@@ -773,7 +771,7 @@ public:
 	 * must be nullptr.
 	 * @return  True if the assignment type-checked.
 	 */
-	bool Assign(IntrusivePtr<Val> index, IntrusivePtr<Val> new_val);
+	bool Assign(zeek::IntrusivePtr<Val> index, zeek::IntrusivePtr<Val> new_val);
 
 	/**
 	 * Assigns a value at an associated index in the table (or in the
@@ -785,8 +783,8 @@ public:
 	 * must be nullptr.
 	 * @return  True if the assignment type-checked.
 	 */
-	bool Assign(IntrusivePtr<Val> index, std::unique_ptr<HashKey> k,
-	            IntrusivePtr<Val> new_val);
+	bool Assign(zeek::IntrusivePtr<Val> index, std::unique_ptr<HashKey> k,
+	            zeek::IntrusivePtr<Val> new_val);
 
 	// Returns true if the assignment typechecked, false if not. The
 	// methods take ownership of new_val, but not of the index.  If we're
@@ -799,7 +797,7 @@ public:
 	[[deprecated("Remove in v4.1.  Use IntrusivePtr overload instead.")]]
 	bool Assign(Val* index, HashKey* k, Val* new_val);
 
-	IntrusivePtr<Val> SizeVal() const override;
+	zeek::IntrusivePtr<Val> SizeVal() const override;
 
 	// Add the entire contents of the table to the given value,
 	// which must also be a TableVal.
@@ -827,7 +825,7 @@ public:
 	 * @param v  The intersecting table.
 	 * @return  The intersection of this table and the given one.
 	 */
-	IntrusivePtr<TableVal> Intersection(const TableVal& v) const;
+	zeek::IntrusivePtr<TableVal> Intersection(const TableVal& v) const;
 
 	[[deprecated("Remove in v4.1.  Use Intersection() instead.")]]
 	TableVal* Intersect(const TableVal* v) const
@@ -853,7 +851,7 @@ public:
 
 	// Expands any lists in the index into multiple initializations.
 	// Returns true if the initializations typecheck, false if not.
-	bool ExpandAndInit(IntrusivePtr<Val> index, IntrusivePtr<Val> new_val);
+	bool ExpandAndInit(zeek::IntrusivePtr<Val> index, zeek::IntrusivePtr<Val> new_val);
 
 	/**
 	 * Finds an index in the table and returns its associated value.
@@ -864,7 +862,7 @@ public:
 	 * non-existent index (nullptr), but otherwise has no meaning in relation
 	 * to the set's contents.
 	 */
-	const IntrusivePtr<Val>& Find(const IntrusivePtr<Val>& index);
+	const zeek::IntrusivePtr<Val>& Find(const zeek::IntrusivePtr<Val>& index);
 
 	/**
 	 * Finds an index in the table and returns its associated value or else
@@ -874,7 +872,7 @@ public:
 	 * exist, instead returns the &default value.  If there's no &default
 	 * attribute, then nullptr is still returned for non-existent index.
 	 */
-	IntrusivePtr<Val> FindOrDefault(const IntrusivePtr<Val>& index);
+	zeek::IntrusivePtr<Val> FindOrDefault(const zeek::IntrusivePtr<Val>& index);
 
 	// Returns the element's value if it exists in the table,
 	// nil otherwise.  Note, "index" is not const because we
@@ -885,12 +883,12 @@ public:
 	// For a table[subnet]/set[subnet], return all subnets that cover
 	// the given subnet.
 	// Causes an internal error if called for any other kind of table.
-	IntrusivePtr<VectorVal> LookupSubnets(const SubNetVal* s);
+	zeek::IntrusivePtr<VectorVal> LookupSubnets(const SubNetVal* s);
 
 	// For a set[subnet]/table[subnet], return a new table that only contains
 	// entries that cover the given subnet.
 	// Causes an internal error if called for any other kind of table.
-	IntrusivePtr<TableVal> LookupSubnetValues(const SubNetVal* s);
+	zeek::IntrusivePtr<TableVal> LookupSubnetValues(const SubNetVal* s);
 
 	// Sets the timestamp for the given index to network time.
 	// Returns false if index does not exist.
@@ -899,7 +897,7 @@ public:
 	/**
 	 * @return  The index corresponding to the given HashKey.
 	 */
-	IntrusivePtr<ListVal> RecreateIndex(const HashKey& k) const;
+	zeek::IntrusivePtr<ListVal> RecreateIndex(const HashKey& k) const;
 
 	[[deprecated("Remove in v4.1.  Use RecreateIndex().")]]
 	ListVal* RecoverIndex(const HashKey* k) const
@@ -913,14 +911,14 @@ public:
 	 * value is returned to differentiate it from non-existent index (nullptr),
 	 * but otherwise has no meaning in relation to the set's contents.
 	 */
-	IntrusivePtr<Val> Remove(const Val& index);
+	zeek::IntrusivePtr<Val> Remove(const Val& index);
 
 	/**
 	 * Same as Remove(const Val&), but uses a precomputed hash key.
 	 * @param k  The hash key to lookup.
 	 * @return  Same as Remove(const Val&).
 	 */
-	IntrusivePtr<Val> Remove(const HashKey& k);
+	zeek::IntrusivePtr<Val> Remove(const HashKey& k);
 
 	[[deprecated("Remove in v4.1.  Use Remove().")]]
 	Val* Delete(const Val* index)
@@ -931,25 +929,25 @@ public:
 		{ return Remove(*k).release(); }
 
 	// Returns a ListVal representation of the table (which must be a set).
-	IntrusivePtr<ListVal> ToListVal(zeek::TypeTag t = zeek::TYPE_ANY) const;
+	zeek::IntrusivePtr<ListVal> ToListVal(zeek::TypeTag t = zeek::TYPE_ANY) const;
 
 	// Returns a ListVal representation of the table (which must be a set
 	// with non-composite index type).
-	IntrusivePtr<ListVal> ToPureListVal() const;
+	zeek::IntrusivePtr<ListVal> ToPureListVal() const;
 
 	[[deprecated("Remove in v4.1.  Use ToListVal() instead.")]]
 	ListVal* ConvertToList(zeek::TypeTag t=zeek::TYPE_ANY) const;
 	[[deprecated("Remove in v4.1.  Use ToPureListVal() instead.")]]
 	ListVal* ConvertToPureList() const;	// must be single index type
 
-	void SetAttrs(IntrusivePtr<zeek::detail::Attributes> attrs);
+	void SetAttrs(zeek::IntrusivePtr<zeek::detail::Attributes> attrs);
 
-	const IntrusivePtr<zeek::detail::Attr>& GetAttr(zeek::detail::AttrTag t) const;
+	const zeek::IntrusivePtr<zeek::detail::Attr>& GetAttr(zeek::detail::AttrTag t) const;
 
 	[[deprecated("Remove in v4.1.  Use GetAttrs().")]]
 	zeek::detail::Attributes* Attrs()	{ return attrs.get(); }
 
-	const IntrusivePtr<zeek::detail::Attributes>& GetAttrs() const
+	const zeek::IntrusivePtr<zeek::detail::Attributes>& GetAttrs() const
 		{ return attrs; }
 
 	// Returns the size of the table.
@@ -1005,22 +1003,22 @@ public:
 	static void DoneParsing();
 
 protected:
-	void Init(IntrusivePtr<zeek::TableType> t);
+	void Init(zeek::IntrusivePtr<zeek::TableType> t);
 
-	using TableRecordDependencies = std::unordered_map<zeek::RecordType*, std::vector<IntrusivePtr<TableVal>>>;
+	using TableRecordDependencies = std::unordered_map<zeek::RecordType*, std::vector<zeek::IntrusivePtr<TableVal>>>;
 
-	using ParseTimeTableState = std::vector<std::pair<IntrusivePtr<Val>, IntrusivePtr<Val>>>;
+	using ParseTimeTableState = std::vector<std::pair<zeek::IntrusivePtr<Val>, zeek::IntrusivePtr<Val>>>;
 	using ParseTimeTableStates = std::unordered_map<TableVal*, ParseTimeTableState>;
 
 	ParseTimeTableState DumpTableState();
 	void RebuildTable(ParseTimeTableState ptts);
 
 	void CheckExpireAttr(zeek::detail::AttrTag at);
-	bool ExpandCompoundAndInit(ListVal* lv, int k, IntrusivePtr<Val> new_val);
-	bool CheckAndAssign(IntrusivePtr<Val> index, IntrusivePtr<Val> new_val);
+	bool ExpandCompoundAndInit(ListVal* lv, int k, zeek::IntrusivePtr<Val> new_val);
+	bool CheckAndAssign(zeek::IntrusivePtr<Val> index, zeek::IntrusivePtr<Val> new_val);
 
 	// Calculates default value for index.  Returns nullptr if none.
-	IntrusivePtr<Val> Default(const IntrusivePtr<Val>& index);
+	zeek::IntrusivePtr<Val> Default(const zeek::IntrusivePtr<Val>& index);
 
 	// Returns true if item expiration is enabled.
 	bool ExpirationEnabled()	{ return expire_time != nullptr; }
@@ -1031,27 +1029,27 @@ protected:
 	double GetExpireTime();
 
 	// Calls &expire_func and returns its return interval;
-	double CallExpireFunc(IntrusivePtr<ListVal> idx);
+	double CallExpireFunc(zeek::IntrusivePtr<ListVal> idx);
 
 	// Enum for the different kinds of changes an &on_change handler can see
 	enum OnChangeType { ELEMENT_NEW, ELEMENT_CHANGED, ELEMENT_REMOVED, ELEMENT_EXPIRED };
 
 	// Calls &change_func. Does not take ownership of values. (Refs if needed).
-	void CallChangeFunc(const Val* index, const IntrusivePtr<Val>& old_value,
+	void CallChangeFunc(const Val* index, const zeek::IntrusivePtr<Val>& old_value,
 	                    OnChangeType tpe);
 
-	IntrusivePtr<Val> DoClone(CloneState* state) override;
+	zeek::IntrusivePtr<Val> DoClone(CloneState* state) override;
 
-	IntrusivePtr<zeek::TableType> table_type;
+	zeek::IntrusivePtr<zeek::TableType> table_type;
 	CompositeHash* table_hash;
-	IntrusivePtr<zeek::detail::Attributes> attrs;
-	IntrusivePtr<zeek::detail::Expr> expire_time;
-	IntrusivePtr<zeek::detail::Expr> expire_func;
+	zeek::IntrusivePtr<zeek::detail::Attributes> attrs;
+	zeek::IntrusivePtr<zeek::detail::Expr> expire_time;
+	zeek::IntrusivePtr<zeek::detail::Expr> expire_func;
 	TableValTimer* timer;
 	IterCookie* expire_cookie;
 	PrefixTable* subnets;
-	IntrusivePtr<Val> def_val;
-	IntrusivePtr<zeek::detail::Expr> change_func;
+	zeek::IntrusivePtr<Val> def_val;
+	zeek::IntrusivePtr<zeek::detail::Expr> change_func;
 	// prevent recursion of change functions
 	bool in_change_func = false;
 
@@ -1063,18 +1061,18 @@ class RecordVal final : public Val, public notifier::Modifiable {
 public:
 	[[deprecated("Remove in v4.1.  Construct from IntrusivePtr instead.")]]
 	explicit RecordVal(zeek::RecordType* t, bool init_fields = true);
-	explicit RecordVal(IntrusivePtr<zeek::RecordType> t, bool init_fields = true);
+	explicit RecordVal(zeek::IntrusivePtr<zeek::RecordType> t, bool init_fields = true);
 
 	~RecordVal() override;
 
-	IntrusivePtr<Val> SizeVal() const override;
+	zeek::IntrusivePtr<Val> SizeVal() const override;
 
 	/**
 	 * Assign a value to a record field.
 	 * @param field  The field index to assign.
 	 * @param new_val  The value to assign.
 	 */
-	void Assign(int field, IntrusivePtr<Val> new_val);
+	void Assign(int field, zeek::IntrusivePtr<Val> new_val);
 
 	/**
 	 * Assign a value of type @c T to a record field, as constructed from
@@ -1085,13 +1083,13 @@ public:
 	 */
 	template <class T, class... Ts>
 	void Assign(int field, Ts&&... args)
-		{ Assign(field, make_intrusive<T>(std::forward<Ts>(args)...)); }
+		{ Assign(field, zeek::make_intrusive<T>(std::forward<Ts>(args)...)); }
 
 	[[deprecated("Remove in v4.1.  Assign an IntrusivePtr instead.")]]
 	void Assign(int field, Val* new_val);
 	// Note: the following nullptr method can also go upon removing the above.
 	void Assign(int field, std::nullptr_t)
-		{ Assign(field, IntrusivePtr<Val>{}); }
+		{ Assign(field, zeek::IntrusivePtr<Val>{}); }
 
 	[[deprecated("Remove in v4.1.  Use GetField().")]]
 	Val* Lookup(int field) const	// Does not Ref() value.
@@ -1102,7 +1100,7 @@ public:
 	 * @param field  The field index to retrieve.
 	 * @return  The value at the given field index.
 	 */
-	const IntrusivePtr<Val>& GetField(int field) const
+	const zeek::IntrusivePtr<Val>& GetField(int field) const
 		{ return (*AsRecord())[field]; }
 
 	/**
@@ -1111,8 +1109,8 @@ public:
 	 * @return  The value at the given field index cast to type @c T.
 	 */
 	template <class T>
-	IntrusivePtr<T> GetField(int field) const
-		{ return cast_intrusive<T>(GetField(field)); }
+	zeek::IntrusivePtr<T> GetField(int field) const
+		{ return zeek::cast_intrusive<T>(GetField(field)); }
 
 	/**
 	 * Returns the value of a given field index if it's previously been
@@ -1122,7 +1120,7 @@ public:
 	 * @return  The value at the given field index or the default value if
 	 * the field hasn't been assigned yet.
 	 */
-	IntrusivePtr<Val> GetFieldOrDefault(int field) const;
+	zeek::IntrusivePtr<Val> GetFieldOrDefault(int field) const;
 
 	[[deprecated("Remove in v4.1.  Use GetFieldOrDefault().")]]
 	Val* LookupWithDefault(int field) const
@@ -1134,7 +1132,7 @@ public:
 	 * @return  The value of the given field.  If no such field name exists,
 	 * a fatal error occurs.
 	 */
-	const IntrusivePtr<Val>& GetField(const char* field) const;
+	const zeek::IntrusivePtr<Val>& GetField(const char* field) const;
 
 	/**
 	 * Returns the value of a given field name as cast to type @c T.
@@ -1143,8 +1141,8 @@ public:
 	 * field name exists, a fatal error occurs.
 	 */
 	template <class T>
-	IntrusivePtr<T> GetField(const char* field) const
-		{ return cast_intrusive<T>(GetField(field)); }
+	zeek::IntrusivePtr<T> GetField(const char* field) const
+		{ return zeek::cast_intrusive<T>(GetField(field)); }
 
 	/**
 	 * Returns the value of a given field name if it's previously been
@@ -1155,7 +1153,7 @@ public:
 	 * if the field hasn't been assigned yet.  If no such field name exists,
 	 * a fatal error occurs.
 	 */
-	IntrusivePtr<Val> GetFieldOrDefault(const char* field) const;
+	zeek::IntrusivePtr<Val> GetFieldOrDefault(const char* field) const;
 
 	/**
 	 * Returns the value of a given field name or its default value
@@ -1165,8 +1163,8 @@ public:
 	 * type @c T.  If no such field name exists, a fatal error occurs.
 	 */
 	template <class T>
-	IntrusivePtr<T> GetFieldOrDefault(const char* field) const
-		{ return cast_intrusive<T>(GetField(field)); }
+	zeek::IntrusivePtr<T> GetFieldOrDefault(const char* field) const
+		{ return zeek::cast_intrusive<T>(GetField(field)); }
 
 	/**
 	 * Looks up the value of a field by field name.  If the field doesn't
@@ -1185,7 +1183,7 @@ public:
 	/**
 	 * Returns a "record_field_table" value for introspection purposes.
 	 */
-	IntrusivePtr<TableVal> GetRecordFieldsVal() const;
+	zeek::IntrusivePtr<TableVal> GetRecordFieldsVal() const;
 
 	// This is an experiment to associate a BroObj within the
 	// event engine to a record value in bro script.
@@ -1203,11 +1201,13 @@ public:
 	//
 	// The *allow_orphaning* parameter allows for a record to be demoted
 	// down to a record type that contains less fields.
-	IntrusivePtr<RecordVal> CoerceTo(IntrusivePtr<zeek::RecordType> other,
-	                                 IntrusivePtr<RecordVal> aggr,
-	                                 bool allow_orphaning = false) const;
-	IntrusivePtr<RecordVal> CoerceTo(IntrusivePtr<zeek::RecordType> other,
-	                                 bool allow_orphaning = false);
+	zeek::IntrusivePtr<RecordVal> CoerceTo(
+		zeek::IntrusivePtr<zeek::RecordType> other,
+		zeek::IntrusivePtr<RecordVal> aggr,
+		bool allow_orphaning = false) const;
+	zeek::IntrusivePtr<RecordVal> CoerceTo(
+		zeek::IntrusivePtr<zeek::RecordType> other,
+		bool allow_orphaning = false);
 
 	unsigned int MemoryAllocation() const override;
 	void DescribeReST(ODesc* d) const override;
@@ -1222,30 +1222,30 @@ public:
 	static void DoneParsing();
 
 protected:
-	IntrusivePtr<Val> DoClone(CloneState* state) override;
+	zeek::IntrusivePtr<Val> DoClone(CloneState* state) override;
 
 	BroObj* origin;
 
-	using RecordTypeValMap = std::unordered_map<zeek::RecordType*, std::vector<IntrusivePtr<RecordVal>>>;
+	using RecordTypeValMap = std::unordered_map<zeek::RecordType*, std::vector<zeek::IntrusivePtr<RecordVal>>>;
 	static RecordTypeValMap parse_time_records;
 };
 
 class EnumVal final : public Val {
 public:
-	IntrusivePtr<Val> SizeVal() const override;
+	zeek::IntrusivePtr<Val> SizeVal() const override;
 
 protected:
 	friend class Val;
 	friend class zeek::EnumType;
 
 	template<class T, class... Ts>
-	friend IntrusivePtr<T> make_intrusive(Ts&&... args);
+	friend zeek::IntrusivePtr<T> zeek::make_intrusive(Ts&&... args);
 
-	EnumVal(IntrusivePtr<zeek::EnumType> t, int i) : Val(bro_int_t(i), std::move(t))
+	EnumVal(zeek::IntrusivePtr<zeek::EnumType> t, int i) : Val(bro_int_t(i), std::move(t))
 		{}
 
 	void ValDescribe(ODesc* d) const override;
-	IntrusivePtr<Val> DoClone(CloneState* state) override;
+	zeek::IntrusivePtr<Val> DoClone(CloneState* state) override;
 };
 
 
@@ -1253,10 +1253,10 @@ class VectorVal final : public Val, public notifier::Modifiable {
 public:
 	[[deprecated("Remove in v4.1.  Construct from IntrusivePtr instead.")]]
 	explicit VectorVal(zeek::VectorType* t);
-	explicit VectorVal(IntrusivePtr<zeek::VectorType> t);
+	explicit VectorVal(zeek::IntrusivePtr<zeek::VectorType> t);
 	~VectorVal() override;
 
-	IntrusivePtr<Val> SizeVal() const override;
+	zeek::IntrusivePtr<Val> SizeVal() const override;
 
 	/**
 	 * Assigns an element to a given vector index.
@@ -1265,22 +1265,22 @@ public:
 	 * @return  True if the element was successfully assigned, or false if
 	 * the element was the wrong type.
 	 */
-	bool Assign(unsigned int index, IntrusivePtr<Val> element);
+	bool Assign(unsigned int index, zeek::IntrusivePtr<Val> element);
 
 	// Note: does NOT Ref() the element! Remember to do so unless
 	//       the element was just created and thus has refcount 1.
 	[[deprecated("Remove in v4.1.  Assign an IntrusivePtr instead.")]]
 	bool Assign(unsigned int index, Val* element)
-		{ return Assign(index, {AdoptRef{}, element}); }
+		{ return Assign(index, {zeek::AdoptRef{}, element}); }
 	// Note: the following nullptr method can also go upon removing the above.
 	void Assign(unsigned int index, std::nullptr_t)
-		{ Assign(index, IntrusivePtr<Val>{}); }
+		{ Assign(index, zeek::IntrusivePtr<Val>{}); }
 
 	[[deprecated("Remove in v4.1.  Assign using integer index and IntrusivePtr element.")]]
 	bool Assign(Val* index, Val* element)
 		{
 		return Assign(index->AsListVal()->Idx(0)->CoerceToUnsigned(),
-		              {AdoptRef{}, element});
+		              {zeek::AdoptRef{}, element});
 		}
 
 	/**
@@ -1291,11 +1291,11 @@ public:
 	 * the element was the wrong type.
 	 */
 	bool AssignRepeat(unsigned int index, unsigned int how_many,
-	                  IntrusivePtr<Val> element);
+	                  zeek::IntrusivePtr<Val> element);
 
 	[[deprecated("Remove in v4.1.  Assign an IntrusivePtr instead.")]]
 	bool AssignRepeat(unsigned int index, unsigned int how_many, Val* element)
-		{ return AssignRepeat(index, how_many, {NewRef{}, element}); }
+		{ return AssignRepeat(index, how_many, {zeek::NewRef{}, element}); }
 
 	// Add this value to the given value (if appropriate).
 	// Returns true if succcessful.
@@ -1307,7 +1307,7 @@ public:
 	 * @return  The element at the given index or nullptr if the index
 	 * does not exist (it's greater than or equal to vector's current size).
 	 */
-	const IntrusivePtr<Val>& At(unsigned int index) const;
+	const zeek::IntrusivePtr<Val>& At(unsigned int index) const;
 
 	[[deprecated("Remove in v4.1.  Use At().")]]
 	Val* Lookup(unsigned int index) const
@@ -1339,44 +1339,44 @@ public:
 	 * @return  True if the element was inserted or false if the element was
 	 * the wrong type.
 	 */
-	bool Insert(unsigned int index, IntrusivePtr<Val> element);
+	bool Insert(unsigned int index, zeek::IntrusivePtr<Val> element);
 
 	[[deprecated("Remove in v4.1.  Insert an IntrusivePtr instead.")]]
 	bool Insert(unsigned int index, Val* element)
-		{ return Insert(index, {AdoptRef{}, element}); }
+		{ return Insert(index, {zeek::AdoptRef{}, element}); }
 
 	// Removes an element at a specific position.
 	bool Remove(unsigned int index);
 
 protected:
 	void ValDescribe(ODesc* d) const override;
-	IntrusivePtr<Val> DoClone(CloneState* state) override;
+	zeek::IntrusivePtr<Val> DoClone(CloneState* state) override;
 };
 
 // Checks the given value for consistency with the given type.  If an
 // exact match, returns it.  If promotable, returns the promoted version.
 // If not a match, generates an error message and return nil.  If is_init is
 // true, then the checking is done in the context of an initialization.
-extern IntrusivePtr<Val> check_and_promote(IntrusivePtr<Val> v,
-                                           const zeek::Type* t, bool is_init,
-                                           const Location* expr_location = nullptr);
+extern zeek::IntrusivePtr<Val> check_and_promote(
+	zeek::IntrusivePtr<Val> v, const zeek::Type* t, bool is_init,
+	const Location* expr_location = nullptr);
 
 extern bool same_val(const Val* v1, const Val* v2);
 extern bool same_atomic_val(const Val* v1, const Val* v2);
 extern bool is_atomic_val(const Val* v);
 extern void describe_vals(const val_list* vals, ODesc* d, int offset=0);
-extern void describe_vals(const std::vector<IntrusivePtr<Val>>& vals,
+extern void describe_vals(const std::vector<zeek::IntrusivePtr<Val>>& vals,
                           ODesc* d, size_t offset = 0);
 extern void delete_vals(val_list* vals);
 
 // True if the given Val* has a vector type.
 inline bool is_vector(Val* v)	{ return  v->GetType()->Tag() == zeek::TYPE_VECTOR; }
-inline bool is_vector(const IntrusivePtr<Val>& v)	{ return is_vector(v.get()); }
+inline bool is_vector(const zeek::IntrusivePtr<Val>& v)	{ return is_vector(v.get()); }
 
 // Returns v casted to type T if the type supports that. Returns null if not.
 //
 // Note: This implements the script-level cast operator.
-extern IntrusivePtr<Val> cast_value_to_type(Val* v, zeek::Type* t);
+extern zeek::IntrusivePtr<Val> cast_value_to_type(Val* v, zeek::Type* t);
 
 // Returns true if v can be casted to type T. If so, check_and_cast() will
 // succeed as well.
diff --git a/src/Var.cc b/src/Var.cc
index 6bed3934a4..6a3356d2ec 100644
--- a/src/Var.cc
+++ b/src/Var.cc
@@ -19,8 +19,9 @@
 
 using namespace zeek::detail;
 
-static IntrusivePtr<Val> init_val(zeek::detail::Expr* init, const zeek::Type* t,
-                                  IntrusivePtr<Val> aggr)
+static zeek::IntrusivePtr<Val> init_val(zeek::detail::Expr* init,
+                                        const zeek::Type* t,
+                                        zeek::IntrusivePtr<Val> aggr)
 	{
 	try
 		{
@@ -32,9 +33,9 @@ static IntrusivePtr<Val> init_val(zeek::detail::Expr* init, const zeek::Type* t,
 		}
 	}
 
-static bool add_prototype(const IntrusivePtr<zeek::detail::ID>& id, zeek::Type* t,
-                          std::vector<IntrusivePtr<zeek::detail::Attr>>* attrs,
-                          const IntrusivePtr<zeek::detail::Expr>& init)
+static bool add_prototype(const zeek::IntrusivePtr<zeek::detail::ID>& id, zeek::Type* t,
+                          std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>* attrs,
+                          const zeek::IntrusivePtr<zeek::detail::Expr>& init)
 	{
 	if ( ! zeek::IsFunc(id->GetType()->Tag()) )
 		return false;
@@ -110,10 +111,10 @@ static bool add_prototype(const IntrusivePtr<zeek::detail::ID>& id, zeek::Type*
 	return true;
 	}
 
-static void make_var(const IntrusivePtr<zeek::detail::ID>& id, IntrusivePtr<zeek::Type> t,
+static void make_var(const zeek::IntrusivePtr<zeek::detail::ID>& id, zeek::IntrusivePtr<zeek::Type> t,
                      zeek::detail::InitClass c,
-                     IntrusivePtr<zeek::detail::Expr> init,
-                     std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>> attr,
+                     zeek::IntrusivePtr<zeek::detail::Expr> init,
+                     std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>> attr,
                      decl_type dt,
                      bool do_init)
 	{
@@ -202,7 +203,7 @@ static void make_var(const IntrusivePtr<zeek::detail::ID>& id, IntrusivePtr<zeek
 	id->SetType(t);
 
 	if ( attr )
-		id->AddAttrs(make_intrusive<zeek::detail::Attributes>(std::move(*attr), t, false, id->IsGlobal()));
+		id->AddAttrs(zeek::make_intrusive<zeek::detail::Attributes>(std::move(*attr), t, false, id->IsGlobal()));
 
 	if ( init )
 		{
@@ -243,26 +244,27 @@ static void make_var(const IntrusivePtr<zeek::detail::ID>& id, IntrusivePtr<zeek
 
 		else if ( dt != VAR_REDEF || init || ! attr )
 			{
-			IntrusivePtr<Val> aggr;
+			zeek::IntrusivePtr<Val> aggr;
 
 			if ( t->Tag() == zeek::TYPE_RECORD )
 				{
-				aggr = make_intrusive<RecordVal>(cast_intrusive<zeek::RecordType>(t));
+				aggr = zeek::make_intrusive<RecordVal>(zeek::cast_intrusive<zeek::RecordType>(t));
 
 				if ( init && t )
 					// Have an initialization and type is not deduced.
-					init = make_intrusive<zeek::detail::RecordCoerceExpr>(std::move(init),
-					        IntrusivePtr{NewRef{}, t->AsRecordType()});
+					init = zeek::make_intrusive<zeek::detail::RecordCoerceExpr>(
+						std::move(init),
+						zeek::IntrusivePtr{zeek::NewRef{}, t->AsRecordType()});
 				}
 
 			else if ( t->Tag() == zeek::TYPE_TABLE )
-				aggr = make_intrusive<TableVal>(cast_intrusive<zeek::TableType>(t),
+				aggr = zeek::make_intrusive<TableVal>(zeek::cast_intrusive<zeek::TableType>(t),
 				                                id->GetAttrs());
 
 			else if ( t->Tag() == zeek::TYPE_VECTOR )
-				aggr = make_intrusive<VectorVal>(cast_intrusive<zeek::VectorType>(t));
+				aggr = zeek::make_intrusive<VectorVal>(zeek::cast_intrusive<zeek::VectorType>(t));
 
-			IntrusivePtr<Val> v;
+			zeek::IntrusivePtr<Val> v;
 
 			if ( init )
 				{
@@ -304,23 +306,23 @@ static void make_var(const IntrusivePtr<zeek::detail::ID>& id, IntrusivePtr<zeek
 		// For events, add a function value (without any body) here so that
 		// we can later access the ID even if no implementations have been
 		// defined.
-		std::vector<IntrusivePtr<zeek::detail::ID>> inits;
-		auto f = make_intrusive<BroFunc>(id, nullptr, inits, 0, 0);
-		id->SetVal(make_intrusive<Val>(std::move(f)));
+		std::vector<zeek::IntrusivePtr<zeek::detail::ID>> inits;
+		auto f = zeek::make_intrusive<BroFunc>(id, nullptr, inits, 0, 0);
+		id->SetVal(zeek::make_intrusive<Val>(std::move(f)));
 		}
 	}
 
-void add_global(const IntrusivePtr<zeek::detail::ID>& id, IntrusivePtr<zeek::Type> t,
-                zeek::detail::InitClass c, IntrusivePtr<zeek::detail::Expr> init,
-                std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>> attr,
+void add_global(const zeek::IntrusivePtr<zeek::detail::ID>& id, zeek::IntrusivePtr<zeek::Type> t,
+                zeek::detail::InitClass c, zeek::IntrusivePtr<zeek::detail::Expr> init,
+                std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>> attr,
                 decl_type dt)
 	{
 	make_var(id, std::move(t), c, std::move(init), std::move(attr), dt, true);
 	}
 
-IntrusivePtr<zeek::detail::Stmt> add_local(IntrusivePtr<zeek::detail::ID> id, IntrusivePtr<zeek::Type> t,
-                                           zeek::detail::InitClass c, IntrusivePtr<zeek::detail::Expr> init,
-                                           std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>> attr,
+zeek::IntrusivePtr<zeek::detail::Stmt> add_local(zeek::IntrusivePtr<zeek::detail::ID> id, zeek::IntrusivePtr<zeek::Type> t,
+                                           zeek::detail::InitClass c, zeek::IntrusivePtr<zeek::detail::Expr> init,
+                                           std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>> attr,
                                            decl_type dt)
 	{
 	make_var(id, std::move(t), c, init, std::move(attr), dt, false);
@@ -334,11 +336,11 @@ IntrusivePtr<zeek::detail::Stmt> add_local(IntrusivePtr<zeek::detail::ID> id, In
 		const Location location = init->GetLocationInfo() ?
 		        *init->GetLocationInfo() : no_location;
 
-		auto name_expr = make_intrusive<zeek::detail::NameExpr>(id, dt == VAR_CONST);
-		auto assign_expr = make_intrusive<zeek::detail::AssignExpr>(std::move(name_expr),
+		auto name_expr = zeek::make_intrusive<zeek::detail::NameExpr>(id, dt == VAR_CONST);
+		auto assign_expr = zeek::make_intrusive<zeek::detail::AssignExpr>(std::move(name_expr),
 		                                                            std::move(init), 0,
 		                                                            nullptr, id->GetAttrs());
-		auto stmt = make_intrusive<zeek::detail::ExprStmt>(std::move(assign_expr));
+		auto stmt = zeek::make_intrusive<zeek::detail::ExprStmt>(std::move(assign_expr));
 		stmt->SetLocationInfo(&location);
 		return stmt;
 		}
@@ -346,26 +348,27 @@ IntrusivePtr<zeek::detail::Stmt> add_local(IntrusivePtr<zeek::detail::ID> id, In
 	else
 		{
 		current_scope()->AddInit(std::move(id));
-		return make_intrusive<zeek::detail::NullStmt>();
+		return zeek::make_intrusive<zeek::detail::NullStmt>();
 		}
 	}
 
-extern IntrusivePtr<zeek::detail::Expr> add_and_assign_local(IntrusivePtr<zeek::detail::ID> id,
-                                               IntrusivePtr<zeek::detail::Expr> init,
-                                               IntrusivePtr<Val> val)
+extern zeek::IntrusivePtr<zeek::detail::Expr> add_and_assign_local(
+	zeek::IntrusivePtr<zeek::detail::ID> id,
+	zeek::IntrusivePtr<zeek::detail::Expr> init,
+	zeek::IntrusivePtr<Val> val)
 	{
 	make_var(id, nullptr, zeek::detail::INIT_FULL, init, nullptr, VAR_REGULAR, false);
-	auto name_expr = make_intrusive<zeek::detail::NameExpr>(std::move(id));
-	return make_intrusive<zeek::detail::AssignExpr>(std::move(name_expr), std::move(init),
-	                                                false, std::move(val));
+	auto name_expr = zeek::make_intrusive<zeek::detail::NameExpr>(std::move(id));
+	return zeek::make_intrusive<zeek::detail::AssignExpr>(
+		std::move(name_expr), std::move(init), false, std::move(val));
 	}
 
-void add_type(zeek::detail::ID* id, IntrusivePtr<zeek::Type> t,
-              std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>> attr)
+void add_type(zeek::detail::ID* id, zeek::IntrusivePtr<zeek::Type> t,
+              std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>> attr)
 	{
 	std::string new_type_name = id->Name();
 	std::string old_type_name = t->GetName();
-	IntrusivePtr<zeek::Type> tnew;
+	zeek::IntrusivePtr<zeek::Type> tnew;
 
 	if ( (t->Tag() == zeek::TYPE_RECORD || t->Tag() == zeek::TYPE_ENUM) &&
 	     old_type_name.empty() )
@@ -386,7 +389,7 @@ void add_type(zeek::detail::ID* id, IntrusivePtr<zeek::Type> t,
 	id->MakeType();
 
 	if ( attr )
-		id->SetAttrs(make_intrusive<zeek::detail::Attributes>(std::move(*attr), tnew, false, false));
+		id->SetAttrs(zeek::make_intrusive<zeek::detail::Attributes>(std::move(*attr), tnew, false, false));
 	}
 
 static void transfer_arg_defaults(zeek::RecordType* args, zeek::RecordType* recv)
@@ -403,8 +406,8 @@ static void transfer_arg_defaults(zeek::RecordType* args, zeek::RecordType* recv
 
 		if ( ! recv_i->attrs )
 			{
-			std::vector<IntrusivePtr<zeek::detail::Attr>> a{def};
-			recv_i->attrs = make_intrusive<zeek::detail::Attributes>(std::move(a),
+			std::vector<zeek::IntrusivePtr<zeek::detail::Attr>> a{def};
+			recv_i->attrs = zeek::make_intrusive<zeek::detail::Attributes>(std::move(a),
 			                                                         recv_i->type,
 			                                                         true, false);
 			}
@@ -414,7 +417,7 @@ static void transfer_arg_defaults(zeek::RecordType* args, zeek::RecordType* recv
 		}
 	}
 
-static zeek::detail::Attr* find_attr(const std::vector<IntrusivePtr<zeek::detail::Attr>>* al,
+static zeek::detail::Attr* find_attr(const std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>* al,
                                      zeek::detail::AttrTag tag)
 	{
 	if ( ! al )
@@ -462,10 +465,10 @@ static bool canonical_arg_types_match(const zeek::FuncType* decl, const zeek::Fu
 	return true;
 	}
 
-void begin_func(IntrusivePtr<zeek::detail::ID> id, const char* module_name,
+void begin_func(zeek::IntrusivePtr<zeek::detail::ID> id, const char* module_name,
                 zeek::FunctionFlavor flavor, bool is_redef,
-                IntrusivePtr<zeek::FuncType> t,
-                std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>> attrs)
+                zeek::IntrusivePtr<zeek::FuncType> t,
+                std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>> attrs)
 	{
 	if ( flavor == zeek::FUNC_FLAVOR_EVENT )
 		{
@@ -636,7 +639,7 @@ TraversalCode OuterIDBindingFinder::PostExpr(const zeek::detail::Expr* expr)
 	return TC_CONTINUE;
 	}
 
-void end_func(IntrusivePtr<zeek::detail::Stmt> body)
+void end_func(zeek::IntrusivePtr<zeek::detail::Stmt> body)
 	{
 	auto ingredients = std::make_unique<function_ingredients>(pop_scope(), std::move(body));
 
@@ -648,14 +651,14 @@ void end_func(IntrusivePtr<zeek::detail::Stmt> body)
 			ingredients->priority);
 	else
 		{
-		auto f = make_intrusive<BroFunc>(
+		auto f = zeek::make_intrusive<BroFunc>(
 			ingredients->id,
 			ingredients->body,
 			ingredients->inits,
 			ingredients->frame_size,
 			ingredients->priority);
 
-		ingredients->id->SetVal(make_intrusive<Val>(std::move(f)));
+		ingredients->id->SetVal(zeek::make_intrusive<Val>(std::move(f)));
 		ingredients->id->SetConst();
 		}
 
diff --git a/src/Var.h b/src/Var.h
index da1adb8a1b..61d7b8052e 100644
--- a/src/Var.h
+++ b/src/Var.h
@@ -18,33 +18,35 @@ ZEEK_FORWARD_DECLARE_NAMESPACED(Expr, zeek::detail);
 
 typedef enum { VAR_REGULAR, VAR_CONST, VAR_REDEF, VAR_OPTION, } decl_type;
 
-extern void add_global(const IntrusivePtr<zeek::detail::ID>& id,
-                       IntrusivePtr<zeek::Type> t,
+extern void add_global(const zeek::IntrusivePtr<zeek::detail::ID>& id,
+                       zeek::IntrusivePtr<zeek::Type> t,
                        zeek::detail::InitClass c,
-                       IntrusivePtr<zeek::detail::Expr> init,
-                       std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>> attr,
+                       zeek::IntrusivePtr<zeek::detail::Expr> init,
+                       std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>> attr,
                        decl_type dt);
 
-extern IntrusivePtr<zeek::detail::Stmt> add_local(IntrusivePtr<zeek::detail::ID> id,
-                                                  IntrusivePtr<zeek::Type> t,
-                                                  zeek::detail::InitClass c,
-                                                  IntrusivePtr<zeek::detail::Expr> init,
-                                                  std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>> attr,
-                                                  decl_type dt);
+extern zeek::IntrusivePtr<zeek::detail::Stmt> add_local(
+	zeek::IntrusivePtr<zeek::detail::ID> id,
+	zeek::IntrusivePtr<zeek::Type> t,
+	zeek::detail::InitClass c,
+	zeek::IntrusivePtr<zeek::detail::Expr> init,
+	std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>> attr,
+	decl_type dt);
 
-extern IntrusivePtr<zeek::detail::Expr> add_and_assign_local(IntrusivePtr<zeek::detail::ID> id,
-                                               IntrusivePtr<zeek::detail::Expr> init,
-                                               IntrusivePtr<Val> val = nullptr);
+extern zeek::IntrusivePtr<zeek::detail::Expr> add_and_assign_local(
+	zeek::IntrusivePtr<zeek::detail::ID> id,
+	zeek::IntrusivePtr<zeek::detail::Expr> init,
+	zeek::IntrusivePtr<Val> val = nullptr);
 
-extern void add_type(zeek::detail::ID* id, IntrusivePtr<zeek::Type> t,
-                     std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>> attr);
+extern void add_type(zeek::detail::ID* id, zeek::IntrusivePtr<zeek::Type> t,
+                     std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>> attr);
 
-extern void begin_func(IntrusivePtr<zeek::detail::ID> id, const char* module_name,
+extern void begin_func(zeek::IntrusivePtr<zeek::detail::ID> id, const char* module_name,
                        zeek::FunctionFlavor flavor, bool is_redef,
-                       IntrusivePtr<zeek::FuncType> t,
-                       std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>> attrs = nullptr);
+                       zeek::IntrusivePtr<zeek::FuncType> t,
+                       std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>> attrs = nullptr);
 
-extern void end_func(IntrusivePtr<zeek::detail::Stmt> body);
+extern void end_func(zeek::IntrusivePtr<zeek::detail::Stmt> body);
 
 // Gather all IDs referenced inside a body that aren't part of a given scope.
 extern id_list gather_outer_ids(Scope* scope, zeek::detail::Stmt* body);
diff --git a/src/ZeekArgs.cc b/src/ZeekArgs.cc
index e9c4b36412..3f480427ef 100644
--- a/src/ZeekArgs.cc
+++ b/src/ZeekArgs.cc
@@ -1,5 +1,4 @@
 #include "ZeekArgs.h"
-#include "IntrusivePtr.h"
 #include "Val.h"
 
 zeek::Args zeek::val_list_to_args(const val_list& vl)
@@ -8,8 +7,7 @@ zeek::Args zeek::val_list_to_args(const val_list& vl)
 	rval.reserve(vl.length());
 
 	for ( auto& v : vl )
-		rval.emplace_back(AdoptRef{}, v);
+		rval.emplace_back(zeek::AdoptRef{}, v);
 
 	return rval;
 	}
-
diff --git a/src/ZeekArgs.h b/src/ZeekArgs.h
index fbde15965c..8b311f4301 100644
--- a/src/ZeekArgs.h
+++ b/src/ZeekArgs.h
@@ -2,16 +2,15 @@
 
 #pragma once
 
+#include <vector>
 #include "BroList.h"
 
-#include <vector>
-
 class Val;
-template <class T> class IntrusivePtr;
 
 namespace zeek {
 
-using Args = std::vector<IntrusivePtr<Val>>;
+template <class T> class IntrusivePtr;
+using Args = std::vector<zeek::IntrusivePtr<Val>>;
 
 /**
  * Converts a legacy-style argument list for use in modern Zeek function
diff --git a/src/analyzer/Analyzer.cc b/src/analyzer/Analyzer.cc
index 76bad9c789..39ee2e439d 100644
--- a/src/analyzer/Analyzer.cc
+++ b/src/analyzer/Analyzer.cc
@@ -710,18 +710,18 @@ void Analyzer::ProtocolViolation(const char* reason, const char* data, int len)
 	if ( ! protocol_violation )
 		return;
 
-	IntrusivePtr<StringVal> r;
+	zeek::IntrusivePtr<StringVal> r;
 
 	if ( data && len )
 		{
 		const char *tmp = copy_string(reason);
-		r = make_intrusive<StringVal>(fmt("%s [%s%s]", tmp,
-					fmt_bytes(data, min(40, len)),
-					len > 40 ? "..." : ""));
+		r = zeek::make_intrusive<StringVal>(fmt("%s [%s%s]", tmp,
+		                                        fmt_bytes(data, min(40, len)),
+		                                        len > 40 ? "..." : ""));
 		delete [] tmp;
 		}
 	else
-		r = make_intrusive<StringVal>(reason);
+		r = zeek::make_intrusive<StringVal>(reason);
 
 	const auto& tval = tag.AsVal();
 	mgr.Enqueue(protocol_violation, ConnVal(), tval, val_mgr->Count(id), std::move(r));
@@ -794,7 +794,7 @@ RecordVal* Analyzer::BuildConnVal()
 	return conn->ConnVal()->Ref()->AsRecordVal();
 	}
 
-const IntrusivePtr<RecordVal>& Analyzer::ConnVal()
+const zeek::IntrusivePtr<RecordVal>& Analyzer::ConnVal()
 	{
 	return conn->ConnVal();
 	}
@@ -806,8 +806,8 @@ void Analyzer::Event(EventHandlerPtr f, const char* name)
 
 void Analyzer::Event(EventHandlerPtr f, Val* v1, Val* v2)
 	{
-	IntrusivePtr val1{AdoptRef{}, v1};
-	IntrusivePtr val2{AdoptRef{}, v2};
+	zeek::IntrusivePtr val1{zeek::AdoptRef{}, v1};
+	zeek::IntrusivePtr val2{zeek::AdoptRef{}, v2};
 
 	if ( f )
 		conn->EnqueueEvent(f, this, conn->ConnVal(), std::move(val1), std::move(val2));
@@ -926,12 +926,12 @@ void TransportLayerAnalyzer::Done()
 	}
 
 void TransportLayerAnalyzer::SetContentsFile(unsigned int /* direction */,
-						IntrusivePtr<BroFile> /* f */)
+                                             zeek::IntrusivePtr<BroFile> /* f */)
 	{
 	reporter->Error("analyzer type does not support writing to a contents file");
 	}
 
-IntrusivePtr<BroFile> TransportLayerAnalyzer::GetContentsFile(unsigned int /* direction */) const
+zeek::IntrusivePtr<BroFile> TransportLayerAnalyzer::GetContentsFile(unsigned int /* direction */) const
 	{
 	reporter->Error("analyzer type does not support writing to a contents file");
 	return nullptr;
@@ -942,7 +942,7 @@ void TransportLayerAnalyzer::PacketContents(const u_char* data, int len)
 	if ( packet_contents && len > 0 )
 		{
 		BroString* cbs = new BroString(data, len, true);
-		auto contents = make_intrusive<StringVal>(cbs);
+		auto contents = zeek::make_intrusive<StringVal>(cbs);
 		EnqueueConnEvent(packet_contents, ConnVal(), std::move(contents));
 		}
 	}
diff --git a/src/analyzer/Analyzer.h b/src/analyzer/Analyzer.h
index 76ef088633..bf4cab4ae9 100644
--- a/src/analyzer/Analyzer.h
+++ b/src/analyzer/Analyzer.h
@@ -556,7 +556,7 @@ public:
 	 * Convenience function that forwards directly to
 	 * Connection::ConnVal().
 	 */
-	const IntrusivePtr<RecordVal>& ConnVal();
+	const zeek::IntrusivePtr<RecordVal>& ConnVal();
 
 	/**
 	 * Convenience function that forwards directly to the corresponding
@@ -604,7 +604,7 @@ public:
 	template <class... Args>
 	std::enable_if_t<
 	  std::is_convertible_v<
-	    std::tuple_element_t<0, std::tuple<Args...>>, IntrusivePtr<Val>>>
+	    std::tuple_element_t<0, std::tuple<Args...>>, zeek::IntrusivePtr<Val>>>
 	EnqueueConnEvent(EventHandlerPtr h, Args&&... args)
 		{ return EnqueueConnEvent(h, zeek::Args{std::forward<Args>(args)...}); }
 
@@ -911,7 +911,7 @@ public:
 	 * @param f The file to record to.
 	 *
 	 */
-	virtual void SetContentsFile(unsigned int direction, IntrusivePtr<BroFile> f);
+	virtual void SetContentsFile(unsigned int direction, zeek::IntrusivePtr<BroFile> f);
 
 	/**
 	 * Returns an associated contents file, if any.  This must only be
@@ -921,7 +921,7 @@ public:
 	 * @param direction One of the CONTENTS_* constants indicating which
 	 * direction the query is for.
 	 */
-	virtual IntrusivePtr<BroFile> GetContentsFile(unsigned int direction) const;
+	virtual zeek::IntrusivePtr<BroFile> GetContentsFile(unsigned int direction) const;
 
 	/**
 	 * Associates a PIA with this analyzer. A PIA takes the
diff --git a/src/analyzer/Manager.cc b/src/analyzer/Manager.cc
index 343641d99c..dce69f8a53 100644
--- a/src/analyzer/Manager.cc
+++ b/src/analyzer/Manager.cc
@@ -463,7 +463,7 @@ bool Manager::BuildInitialAnalyzerTree(Connection* conn)
 			if ( resp_port == 22 || resp_port == 23 || resp_port == 513 )
 				{
 				static auto stp_skip_src = zeek::id::find_val<TableVal>("stp_skip_src");
-				auto src = make_intrusive<AddrVal>(conn->OrigAddr());
+				auto src = zeek::make_intrusive<AddrVal>(conn->OrigAddr());
 
 				if ( ! stp_skip_src->FindOrDefault(src) )
 					tcp->AddChildAnalyzer(new stepping_stone::SteppingStone_Analyzer(conn), false);
@@ -576,7 +576,7 @@ void Manager::ScheduleAnalyzer(const IPAddr& orig, const IPAddr& resp,
 void Manager::ScheduleAnalyzer(const IPAddr& orig, const IPAddr& resp, PortVal* resp_p,
 			       Val* analyzer, double timeout)
 	{
-	IntrusivePtr<EnumVal> ev{NewRef{}, analyzer->AsEnumVal()};
+	zeek::IntrusivePtr<EnumVal> ev{zeek::NewRef{}, analyzer->AsEnumVal()};
 	return ScheduleAnalyzer(orig, resp, resp_p->Port(), resp_p->PortType(),
 	                        Tag(std::move(ev)), timeout);
 	}
diff --git a/src/analyzer/Tag.cc b/src/analyzer/Tag.cc
index 228668e15d..e082734c90 100644
--- a/src/analyzer/Tag.cc
+++ b/src/analyzer/Tag.cc
@@ -16,7 +16,7 @@ analyzer::Tag& analyzer::Tag::operator=(const analyzer::Tag& other)
 	return *this;
 	}
 
-const IntrusivePtr<EnumVal>& analyzer::Tag::AsVal() const
+const zeek::IntrusivePtr<EnumVal>& analyzer::Tag::AsVal() const
 	{
 	return ::Tag::AsVal(analyzer_mgr->GetTagType());
 	}
@@ -26,10 +26,10 @@ EnumVal* analyzer::Tag::AsEnumVal() const
 	return AsVal().get();
 	}
 
-analyzer::Tag::Tag(IntrusivePtr<EnumVal> val)
+analyzer::Tag::Tag(zeek::IntrusivePtr<EnumVal> val)
 	: ::Tag(std::move(val))
 	{ }
 
 analyzer::Tag::Tag(EnumVal* val)
-	: ::Tag({NewRef{}, val})
+	: ::Tag({zeek::NewRef{}, val})
 	{ }
diff --git a/src/analyzer/Tag.h b/src/analyzer/Tag.h
index 18eaf2fdf6..6b6dd2e8d5 100644
--- a/src/analyzer/Tag.h
+++ b/src/analyzer/Tag.h
@@ -89,7 +89,7 @@ public:
 	 *
 	 * @param etype the script-layer enum type associated with the tag.
 	 */
-	const IntrusivePtr<EnumVal>& AsVal() const;
+	const zeek::IntrusivePtr<EnumVal>& AsVal() const;
 
 	[[deprecated("Remove in v4.1.  Use AsVal() instead.")]]
 	EnumVal* AsEnumVal() const;
@@ -118,7 +118,7 @@ protected:
 	 *
 	 * @param val An enum value of script type \c Analyzer::Tag.
 	 */
-	explicit Tag(IntrusivePtr<EnumVal> val);
+	explicit Tag(zeek::IntrusivePtr<EnumVal> val);
 
 	[[deprecated("Remove in v4.1.  Construct from IntrusivePtr instead")]]
 	explicit Tag(EnumVal* val);
diff --git a/src/analyzer/analyzer.bif b/src/analyzer/analyzer.bif
index 849b75d693..8a8ade4d5f 100644
--- a/src/analyzer/analyzer.bif
+++ b/src/analyzer/analyzer.bif
@@ -41,8 +41,8 @@ function Analyzer::__schedule_analyzer%(orig: addr, resp: addr, resp_p: port,
 
 function __name%(atype: Analyzer::Tag%) : string
 	%{
-	const auto& n = analyzer_mgr->GetComponentName(IntrusivePtr{NewRef{}, atype->AsEnumVal()});
-	return make_intrusive<StringVal>(n);
+	const auto& n = analyzer_mgr->GetComponentName(zeek::IntrusivePtr{zeek::NewRef{}, atype->AsEnumVal()});
+	return zeek::make_intrusive<StringVal>(n);
 	%}
 
 function __tag%(name: string%) : Analyzer::Tag
diff --git a/src/analyzer/protocol/arp/ARP.cc b/src/analyzer/protocol/arp/ARP.cc
index 4d8b83b8b8..cb0486c522 100644
--- a/src/analyzer/protocol/arp/ARP.cc
+++ b/src/analyzer/protocol/arp/ARP.cc
@@ -196,7 +196,7 @@ void ARP_Analyzer::BadARP(const struct arp_pkthdr* hdr, const char* msg)
 		ToEthAddrStr((const u_char*) ar_sha(hdr)),
 		ToAddrVal(ar_tpa(hdr)),
 		ToEthAddrStr((const u_char*) ar_tha(hdr)),
-		make_intrusive<StringVal>(msg)
+		zeek::make_intrusive<StringVal>(msg)
 	);
 	}
 
@@ -226,19 +226,19 @@ void ARP_Analyzer::RREvent(EventHandlerPtr e,
 AddrVal* ARP_Analyzer::ConstructAddrVal(const void* addr)
 	{ return ToAddrVal(addr).release(); }
 
-IntrusivePtr<AddrVal> ARP_Analyzer::ToAddrVal(const void* addr)
+zeek::IntrusivePtr<AddrVal> ARP_Analyzer::ToAddrVal(const void* addr)
 	{
 	// ### For now, we only handle IPv4 addresses.
-	return make_intrusive<AddrVal>(*(const uint32_t*) addr);
+	return zeek::make_intrusive<AddrVal>(*(const uint32_t*) addr);
 	}
 
 StringVal* ARP_Analyzer::EthAddrToStr(const u_char* addr)
 	{ return ToEthAddrStr(addr).release(); }
 
-IntrusivePtr<StringVal> ARP_Analyzer::ToEthAddrStr(const u_char* addr)
+zeek::IntrusivePtr<StringVal> ARP_Analyzer::ToEthAddrStr(const u_char* addr)
 	{
 	char buf[1024];
 	snprintf(buf, sizeof(buf), "%02x:%02x:%02x:%02x:%02x:%02x",
 			addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
-	return make_intrusive<StringVal>(buf);
+	return zeek::make_intrusive<StringVal>(buf);
 	}
diff --git a/src/analyzer/protocol/arp/ARP.h b/src/analyzer/protocol/arp/ARP.h
index d1de7de01f..fb710bc61f 100644
--- a/src/analyzer/protocol/arp/ARP.h
+++ b/src/analyzer/protocol/arp/ARP.h
@@ -51,8 +51,8 @@ protected:
 	[[deprecated("Remove in v4.1.  Use ToEthAddrStr().")]]
 	StringVal* EthAddrToStr(const u_char* addr);
 
-	IntrusivePtr<AddrVal> ToAddrVal(const void* addr);
-	IntrusivePtr<StringVal> ToEthAddrStr(const u_char* addr);
+	zeek::IntrusivePtr<AddrVal> ToAddrVal(const void* addr);
+	zeek::IntrusivePtr<StringVal> ToEthAddrStr(const u_char* addr);
 	void BadARP(const struct arp_pkthdr* hdr, const char* string);
 	void Corrupted(const char* string);
 };
diff --git a/src/analyzer/protocol/asn1/asn1.pac b/src/analyzer/protocol/asn1/asn1.pac
index 4e87e11c1a..b96b5e620a 100644
--- a/src/analyzer/protocol/asn1/asn1.pac
+++ b/src/analyzer/protocol/asn1/asn1.pac
@@ -3,12 +3,12 @@
 %}
 
 %header{
-	IntrusivePtr<Val> asn1_integer_to_val(const ASN1Encoding* i, zeek::TypeTag t);
-	IntrusivePtr<Val> asn1_integer_to_val(const ASN1Integer* i, zeek::TypeTag t);
-	IntrusivePtr<StringVal> asn1_oid_to_val(const ASN1Encoding* oid);
-	IntrusivePtr<StringVal> asn1_oid_to_val(const ASN1ObjectIdentifier* oid);
-	IntrusivePtr<StringVal> asn1_octet_string_to_val(const ASN1Encoding* s);
-	IntrusivePtr<StringVal> asn1_octet_string_to_val(const ASN1OctetString* s);
+	zeek::IntrusivePtr<Val> asn1_integer_to_val(const ASN1Encoding* i, zeek::TypeTag t);
+	zeek::IntrusivePtr<Val> asn1_integer_to_val(const ASN1Integer* i, zeek::TypeTag t);
+	zeek::IntrusivePtr<StringVal> asn1_oid_to_val(const ASN1Encoding* oid);
+	zeek::IntrusivePtr<StringVal> asn1_oid_to_val(const ASN1ObjectIdentifier* oid);
+	zeek::IntrusivePtr<StringVal> asn1_octet_string_to_val(const ASN1Encoding* s);
+	zeek::IntrusivePtr<StringVal> asn1_octet_string_to_val(const ASN1OctetString* s);
 %}
 
 ############################## ASN.1 Encodings
@@ -102,12 +102,12 @@ function binary_to_int64(bs: bytestring): int64
 
 %code{
 
-IntrusivePtr<Val> asn1_integer_to_val(const ASN1Integer* i, zeek::TypeTag t)
+zeek::IntrusivePtr<Val> asn1_integer_to_val(const ASN1Integer* i, zeek::TypeTag t)
 	{
 	return asn1_integer_to_val(i->encoding(), t);
 	}
 
-IntrusivePtr<Val> asn1_integer_to_val(const ASN1Encoding* i, zeek::TypeTag t)
+zeek::IntrusivePtr<Val> asn1_integer_to_val(const ASN1Encoding* i, zeek::TypeTag t)
 	{
 	auto v = binary_to_int64(i->content());
 
@@ -125,12 +125,12 @@ IntrusivePtr<Val> asn1_integer_to_val(const ASN1Encoding* i, zeek::TypeTag t)
 	}
 	}
 
-IntrusivePtr<StringVal> asn1_oid_to_val(const ASN1ObjectIdentifier* oid)
+zeek::IntrusivePtr<StringVal> asn1_oid_to_val(const ASN1ObjectIdentifier* oid)
 	{
 	return asn1_oid_to_val(oid->encoding());
 	}
 
-IntrusivePtr<StringVal> asn1_oid_to_val(const ASN1Encoding* oid)
+zeek::IntrusivePtr<StringVal> asn1_oid_to_val(const ASN1Encoding* oid)
 	{
 	vector<uint64> oid_components;
 	vector<vector<uint8> > subidentifiers;
@@ -191,17 +191,17 @@ IntrusivePtr<StringVal> asn1_oid_to_val(const ASN1Encoding* oid)
 			}
 		}
 
-	return make_intrusive<StringVal>(rval);
+	return zeek::make_intrusive<StringVal>(rval);
 	}
 
-IntrusivePtr<StringVal> asn1_octet_string_to_val(const ASN1OctetString* s)
+zeek::IntrusivePtr<StringVal> asn1_octet_string_to_val(const ASN1OctetString* s)
 	{
 	return asn1_octet_string_to_val(s->encoding());
 	}
 
-IntrusivePtr<StringVal> asn1_octet_string_to_val(const ASN1Encoding* s)
+zeek::IntrusivePtr<StringVal> asn1_octet_string_to_val(const ASN1Encoding* s)
 	{
 	bytestring const& bs = s->content();
-	return make_intrusive<StringVal>(bs.length(), reinterpret_cast<const char*>(bs.data()));
+	return zeek::make_intrusive<StringVal>(bs.length(), reinterpret_cast<const char*>(bs.data()));
 	}
 %}
diff --git a/src/analyzer/protocol/bittorrent/BitTorrent.cc b/src/analyzer/protocol/bittorrent/BitTorrent.cc
index bfc9e6be51..84bca00c39 100644
--- a/src/analyzer/protocol/bittorrent/BitTorrent.cc
+++ b/src/analyzer/protocol/bittorrent/BitTorrent.cc
@@ -122,6 +122,6 @@ void BitTorrent_Analyzer::DeliverWeird(const char* msg, bool orig)
 		EnqueueConnEvent(bittorrent_peer_weird,
 			ConnVal(),
 			val_mgr->Bool(orig),
-			make_intrusive<StringVal>(msg)
+			zeek::make_intrusive<StringVal>(msg)
 		);
 	}
diff --git a/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc b/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc
index c73644991a..628a1fdbf7 100644
--- a/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc
+++ b/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc
@@ -15,11 +15,11 @@
 
 using namespace analyzer::bittorrent;
 
-static IntrusivePtr<zeek::TableType> bt_tracker_headers;
-static IntrusivePtr<zeek::RecordType> bittorrent_peer;
-static IntrusivePtr<zeek::TableType> bittorrent_peer_set;
-static IntrusivePtr<zeek::RecordType> bittorrent_benc_value;
-static IntrusivePtr<zeek::TableType> bittorrent_benc_dir;
+static zeek::IntrusivePtr<zeek::TableType> bt_tracker_headers;
+static zeek::IntrusivePtr<zeek::RecordType> bittorrent_peer;
+static zeek::IntrusivePtr<zeek::TableType> bittorrent_peer_set;
+static zeek::IntrusivePtr<zeek::RecordType> bittorrent_benc_value;
+static zeek::IntrusivePtr<zeek::TableType> bittorrent_benc_dir;
 
 BitTorrentTracker_Analyzer::BitTorrentTracker_Analyzer(Connection* c)
 : tcp::TCP_ApplicationAnalyzer("BITTORRENTTRACKER", c)
@@ -248,7 +248,7 @@ void BitTorrentTracker_Analyzer::DeliverWeird(const char* msg, bool orig)
 		EnqueueConnEvent(bt_tracker_weird,
 			ConnVal(),
 			val_mgr->Bool(orig),
-			make_intrusive<StringVal>(msg)
+			zeek::make_intrusive<StringVal>(msg)
 		);
 	}
 
@@ -347,9 +347,9 @@ void BitTorrentTracker_Analyzer::EmitRequest(void)
 
 	if ( bt_tracker_request )
 		EnqueueConnEvent(bt_tracker_request,
-			ConnVal(),
-			IntrusivePtr{AdoptRef{}, req_val_uri},
-			IntrusivePtr{AdoptRef{}, req_val_headers}
+		                 ConnVal(),
+		                 zeek::IntrusivePtr{zeek::AdoptRef{}, req_val_uri},
+		                 zeek::IntrusivePtr{zeek::AdoptRef{}, req_val_headers}
 		);
 
 	req_val_uri = nullptr;
@@ -400,10 +400,11 @@ bool BitTorrentTracker_Analyzer::ParseResponse(char* line)
 			if ( res_status != 200 )
 				{
 				if ( bt_tracker_response_not_ok )
-					EnqueueConnEvent(bt_tracker_response_not_ok,
+					EnqueueConnEvent(
+						bt_tracker_response_not_ok,
 						ConnVal(),
 						val_mgr->Count(res_status),
-						IntrusivePtr{AdoptRef{}, res_val_headers}
+						zeek::IntrusivePtr{zeek::AdoptRef{}, res_val_headers}
 					);
 				res_val_headers = nullptr;
 				res_buf_pos = res_buf + res_buf_len;
@@ -477,17 +478,17 @@ void BitTorrentTracker_Analyzer::ResponseBenc(int name_len, char* name,
 			uint32_t ad = extract_uint32((u_char*) value);
 			uint16_t pt = ntohs((value[4] << 8) | value[5]);
 
-			auto peer = make_intrusive<RecordVal>(bittorrent_peer);
-			peer->Assign(0, make_intrusive<AddrVal>(ad));
+			auto peer = zeek::make_intrusive<RecordVal>(bittorrent_peer);
+			peer->Assign(0, zeek::make_intrusive<AddrVal>(ad));
 			peer->Assign(1, val_mgr->Port(pt, TRANSPORT_TCP));
 			res_val_peers->Assign(std::move(peer), nullptr);
 			}
 		}
 	else
 		{
-		auto name_ = make_intrusive<StringVal>(name_len, name);
-		auto benc_value = make_intrusive<RecordVal>(bittorrent_benc_value);
-		benc_value->Assign(type, make_intrusive<StringVal>(value_len, value));
+		auto name_ = zeek::make_intrusive<StringVal>(name_len, name);
+		auto benc_value = zeek::make_intrusive<RecordVal>(bittorrent_benc_value);
+		benc_value->Assign(type, zeek::make_intrusive<StringVal>(value_len, value));
 		res_val_benc->Assign(std::move(name_), std::move(benc_value));
 		}
 	}
@@ -495,8 +496,8 @@ void BitTorrentTracker_Analyzer::ResponseBenc(int name_len, char* name,
 void BitTorrentTracker_Analyzer::ResponseBenc(int name_len, char* name,
 				enum btt_benc_types type, bro_int_t value)
 	{
-	auto benc_value = make_intrusive<RecordVal>(bittorrent_benc_value);
-	auto name_ = make_intrusive<StringVal>(name_len, name);
+	auto benc_value = zeek::make_intrusive<RecordVal>(bittorrent_benc_value);
+	auto name_ = zeek::make_intrusive<StringVal>(name_len, name);
 
 	benc_value->Assign(type, val_mgr->Int(value));
 	res_val_benc->Assign(std::move(name_), std::move(benc_value));
@@ -782,11 +783,11 @@ void BitTorrentTracker_Analyzer::EmitResponse(void)
 
 	if ( bt_tracker_response )
 		EnqueueConnEvent(bt_tracker_response,
-			ConnVal(),
-			val_mgr->Count(res_status),
-			IntrusivePtr{AdoptRef{}, res_val_headers},
-			IntrusivePtr{AdoptRef{}, res_val_peers},
-			IntrusivePtr{AdoptRef{}, res_val_benc}
+		                 ConnVal(),
+		                 val_mgr->Count(res_status),
+		                 zeek::IntrusivePtr{zeek::AdoptRef{}, res_val_headers},
+		                 zeek::IntrusivePtr{zeek::AdoptRef{}, res_val_peers},
+		                 zeek::IntrusivePtr{zeek::AdoptRef{}, res_val_benc}
 		);
 
 	res_val_headers = nullptr;
diff --git a/src/analyzer/protocol/conn-size/ConnSize.cc b/src/analyzer/protocol/conn-size/ConnSize.cc
index f356f39e3f..0d40d41fd5 100644
--- a/src/analyzer/protocol/conn-size/ConnSize.cc
+++ b/src/analyzer/protocol/conn-size/ConnSize.cc
@@ -94,7 +94,7 @@ void ConnSize_Analyzer::CheckThresholds(bool is_orig)
 			{
 			EnqueueConnEvent(conn_duration_threshold_crossed,
 					ConnVal(),
-					make_intrusive<IntervalVal>(duration_thresh),
+					zeek::make_intrusive<IntervalVal>(duration_thresh),
 					val_mgr->Bool(is_orig)
 			);
 			duration_thresh = 0;
diff --git a/src/analyzer/protocol/conn-size/functions.bif b/src/analyzer/protocol/conn-size/functions.bif
index 9c2a506a99..8753ae8a32 100644
--- a/src/analyzer/protocol/conn-size/functions.bif
+++ b/src/analyzer/protocol/conn-size/functions.bif
@@ -139,7 +139,7 @@ function get_current_conn_duration_threshold%(cid: conn_id%): interval
 	%{
 	analyzer::Analyzer* a = GetConnsizeAnalyzer(cid);
 	if ( ! a )
-		return make_intrusive<IntervalVal>(0.0);
+		return zeek::make_intrusive<IntervalVal>(0.0);
 
-	return make_intrusive<IntervalVal>(static_cast<analyzer::conn_size::ConnSize_Analyzer*>(a)->GetDurationThreshold());
+	return zeek::make_intrusive<IntervalVal>(static_cast<analyzer::conn_size::ConnSize_Analyzer*>(a)->GetDurationThreshold());
 	%}
diff --git a/src/analyzer/protocol/dce-rpc/dce_rpc-analyzer.pac b/src/analyzer/protocol/dce-rpc/dce_rpc-analyzer.pac
index c6bdbd3ab8..7cfe0ab250 100644
--- a/src/analyzer/protocol/dce-rpc/dce_rpc-analyzer.pac
+++ b/src/analyzer/protocol/dce-rpc/dce_rpc-analyzer.pac
@@ -83,14 +83,14 @@ refine connection DCE_RPC_Conn += {
 		%{
 		if ( dce_rpc_bind_ack )
 			{
-			IntrusivePtr<StringVal> sec_addr;
+			zeek::IntrusivePtr<StringVal> sec_addr;
 
 			// Remove the null from the end of the string if it's there.
 			if ( ${bind.sec_addr}.length() > 0 &&
 			     *(${bind.sec_addr}.begin() + ${bind.sec_addr}.length()) == 0 )
-				sec_addr = make_intrusive<StringVal>(${bind.sec_addr}.length()-1, (const char*) ${bind.sec_addr}.begin());
+				sec_addr = zeek::make_intrusive<StringVal>(${bind.sec_addr}.length()-1, (const char*) ${bind.sec_addr}.begin());
 			else
-				sec_addr = make_intrusive<StringVal>(${bind.sec_addr}.length(), (const char*) ${bind.sec_addr}.begin());
+				sec_addr = zeek::make_intrusive<StringVal>(${bind.sec_addr}.length(), (const char*) ${bind.sec_addr}.begin());
 
 			zeek::BifEvent::enqueue_dce_rpc_bind_ack(bro_analyzer(),
 			                                   bro_analyzer()->Conn(),
@@ -175,4 +175,3 @@ refine typeattr DCE_RPC_Request += &let {
 refine typeattr DCE_RPC_Response += &let {
 	proc = $context.connection.process_dce_rpc_response(this);
 };
-
diff --git a/src/analyzer/protocol/dhcp/dhcp-analyzer.pac b/src/analyzer/protocol/dhcp/dhcp-analyzer.pac
index 1228322d39..4adb8ee1a4 100644
--- a/src/analyzer/protocol/dhcp/dhcp-analyzer.pac
+++ b/src/analyzer/protocol/dhcp/dhcp-analyzer.pac
@@ -1,8 +1,8 @@
 
 refine flow DHCP_Flow += {
 	%member{
-		IntrusivePtr<RecordVal> options;
-		IntrusivePtr<VectorVal> all_options;
+		zeek::IntrusivePtr<RecordVal> options;
+		zeek::IntrusivePtr<VectorVal> all_options;
 	%}
 
 	%init{
@@ -19,8 +19,8 @@ refine flow DHCP_Flow += {
 		%{
 		if ( ! options )
 			{
-			options = make_intrusive<RecordVal>(zeek::BifType::Record::DHCP::Options);
-			all_options = make_intrusive<VectorVal>(zeek::id::index_vec);
+			options = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::DHCP::Options);
+			all_options = zeek::make_intrusive<VectorVal>(zeek::id::index_vec);
 			options->Assign(0, all_options);
 			}
 
@@ -53,17 +53,17 @@ refine flow DHCP_Flow += {
 			std::string mac_str = fmt_mac(${msg.chaddr}.data(), ${msg.chaddr}.length());
 			double secs = static_cast<double>(${msg.secs});
 
-			auto dhcp_msg_val = make_intrusive<RecordVal>(zeek::BifType::Record::DHCP::Msg);
+			auto dhcp_msg_val = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::DHCP::Msg);
 			dhcp_msg_val->Assign(0, val_mgr->Count(${msg.op}));
 			dhcp_msg_val->Assign(1, val_mgr->Count(${msg.type}));
 			dhcp_msg_val->Assign(2, val_mgr->Count(${msg.xid}));
-			dhcp_msg_val->Assign(3, make_intrusive<IntervalVal>(secs));
+			dhcp_msg_val->Assign(3, zeek::make_intrusive<IntervalVal>(secs));
 			dhcp_msg_val->Assign(4, val_mgr->Count(${msg.flags}));
-			dhcp_msg_val->Assign(5, make_intrusive<AddrVal>(htonl(${msg.ciaddr})));
-			dhcp_msg_val->Assign(6, make_intrusive<AddrVal>(htonl(${msg.yiaddr})));
-			dhcp_msg_val->Assign(7, make_intrusive<AddrVal>(htonl(${msg.siaddr})));
-			dhcp_msg_val->Assign(8, make_intrusive<AddrVal>(htonl(${msg.giaddr})));
-			dhcp_msg_val->Assign(9, make_intrusive<StringVal>(mac_str));
+			dhcp_msg_val->Assign(5, zeek::make_intrusive<AddrVal>(htonl(${msg.ciaddr})));
+			dhcp_msg_val->Assign(6, zeek::make_intrusive<AddrVal>(htonl(${msg.yiaddr})));
+			dhcp_msg_val->Assign(7, zeek::make_intrusive<AddrVal>(htonl(${msg.siaddr})));
+			dhcp_msg_val->Assign(8, zeek::make_intrusive<AddrVal>(htonl(${msg.giaddr})));
+			dhcp_msg_val->Assign(9, zeek::make_intrusive<StringVal>(mac_str));
 
 			int last_non_null = 0;
 
@@ -74,7 +74,7 @@ refine flow DHCP_Flow += {
 				}
 
 			if ( last_non_null > 0 )
-				dhcp_msg_val->Assign(10, make_intrusive<StringVal>(last_non_null + 1,
+				dhcp_msg_val->Assign(10, zeek::make_intrusive<StringVal>(last_non_null + 1,
 				                                                   reinterpret_cast<const char*>(${msg.sname}.begin())));
 
 			last_non_null = 0;
@@ -86,7 +86,7 @@ refine flow DHCP_Flow += {
 				}
 
 			if ( last_non_null > 0 )
-				dhcp_msg_val->Assign(11, make_intrusive<StringVal>(last_non_null + 1,
+				dhcp_msg_val->Assign(11, zeek::make_intrusive<StringVal>(last_non_null + 1,
 				                                                   reinterpret_cast<const char*>(${msg.file_n}.begin())));
 
 			init_options();
diff --git a/src/analyzer/protocol/dhcp/dhcp-options.pac b/src/analyzer/protocol/dhcp/dhcp-options.pac
index b572f297b3..6c35fb202f 100644
--- a/src/analyzer/protocol/dhcp/dhcp-options.pac
+++ b/src/analyzer/protocol/dhcp/dhcp-options.pac
@@ -11,7 +11,7 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_subnet_option(v: OptionValue): bool
 		%{
-		${context.flow}->options->Assign(1, make_intrusive<AddrVal>(htonl(${v.subnet})));
+		${context.flow}->options->Assign(1, zeek::make_intrusive<AddrVal>(htonl(${v.subnet})));
 		return true;
 		%}
 };
@@ -57,14 +57,14 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_router_option(v: OptionValue): bool
 		%{
-		auto router_list = make_intrusive<VectorVal>(zeek::BifType::Vector::DHCP::Addrs);
+		auto router_list = zeek::make_intrusive<VectorVal>(zeek::BifType::Vector::DHCP::Addrs);
 		int num_routers = ${v.router_list}->size();
 		vector<uint32>* rlist = ${v.router_list};
 
 		for ( int i = 0; i < num_routers; ++i )
 			{
 			uint32 raddr = (*rlist)[i];
-			router_list->Assign(i, make_intrusive<AddrVal>(htonl(raddr)));
+			router_list->Assign(i, zeek::make_intrusive<AddrVal>(htonl(raddr)));
 			}
 
 		${context.flow}->options->Assign(2, std::move(router_list));
@@ -91,14 +91,14 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_timeserver_option(v: OptionValue): bool
 		%{
-		auto timeserver_list = make_intrusive<VectorVal>(zeek::BifType::Vector::DHCP::Addrs);
+		auto timeserver_list = zeek::make_intrusive<VectorVal>(zeek::BifType::Vector::DHCP::Addrs);
 		int num_servers = ${v.timeserver_list}->size();
 		vector<uint32>* rlist = ${v.timeserver_list};
 
 		for ( int i = 0; i < num_servers; ++i )
 			{
 			uint32 raddr = (*rlist)[i];
-			timeserver_list->Assign(i, make_intrusive<AddrVal>(htonl(raddr)));
+			timeserver_list->Assign(i, zeek::make_intrusive<AddrVal>(htonl(raddr)));
 			}
 
 		${context.flow}->options->Assign(26, std::move(timeserver_list));
@@ -125,14 +125,14 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_nameserver_option(v: OptionValue): bool
 		%{
-		auto nameserver_list = make_intrusive<VectorVal>(zeek::BifType::Vector::DHCP::Addrs);
+		auto nameserver_list = zeek::make_intrusive<VectorVal>(zeek::BifType::Vector::DHCP::Addrs);
 		int num_servers = ${v.nameserver_list}->size();
 		vector<uint32>* rlist = ${v.nameserver_list};
 
 		for ( int i = 0; i < num_servers; ++i )
 			{
 			uint32 raddr = (*rlist)[i];
-			nameserver_list->Assign(i, make_intrusive<AddrVal>(htonl(raddr)));
+			nameserver_list->Assign(i, zeek::make_intrusive<AddrVal>(htonl(raddr)));
 			}
 
 		${context.flow}->options->Assign(27, std::move(nameserver_list));
@@ -159,14 +159,14 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_dns_server_option(v: OptionValue): bool
 		%{
-		auto server_list = make_intrusive<VectorVal>(zeek::BifType::Vector::DHCP::Addrs);
+		auto server_list = zeek::make_intrusive<VectorVal>(zeek::BifType::Vector::DHCP::Addrs);
 		int num_servers = ${v.dns_server_list}->size();
 		vector<uint32>* rlist = ${v.dns_server_list};
 
 		for ( int i = 0; i < num_servers; ++i )
 			{
 			uint32 raddr = (*rlist)[i];
-			server_list->Assign(i, make_intrusive<AddrVal>(htonl(raddr)));
+			server_list->Assign(i, zeek::make_intrusive<AddrVal>(htonl(raddr)));
 			}
 
 		${context.flow}->options->Assign(3, std::move(server_list));
@@ -192,7 +192,7 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_host_name_option(v: OptionValue): bool
 		%{
-		${context.flow}->options->Assign(4, make_intrusive<StringVal>(${v.host_name}.length(),
+		${context.flow}->options->Assign(4, zeek::make_intrusive<StringVal>(${v.host_name}.length(),
 		                                                  reinterpret_cast<const char*>(${v.host_name}.begin())));
 
 		return true;
@@ -225,7 +225,7 @@ refine flow DHCP_Flow += {
 				last_non_null = i;
 			}
 
-		${context.flow}->options->Assign(5, make_intrusive<StringVal>(last_non_null == 0 ? 0 : last_non_null + 1,
+		${context.flow}->options->Assign(5, zeek::make_intrusive<StringVal>(last_non_null == 0 ? 0 : last_non_null + 1,
 		                                                  reinterpret_cast<const char*>(${v.domain_name}.begin())));
 
 		return true;
@@ -274,7 +274,7 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_broadcast_address_option(v: OptionValue): bool
 		%{
-		${context.flow}->options->Assign(7, make_intrusive<AddrVal>(htonl(${v.broadcast_address})));
+		${context.flow}->options->Assign(7, zeek::make_intrusive<AddrVal>(htonl(${v.broadcast_address})));
 
 		return true;
 		%}
@@ -298,14 +298,14 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_ntpserver_option(v: OptionValue): bool
 		%{
-		auto ntpserver_list = make_intrusive<VectorVal>(zeek::BifType::Vector::DHCP::Addrs);
+		auto ntpserver_list = zeek::make_intrusive<VectorVal>(zeek::BifType::Vector::DHCP::Addrs);
 		int num_servers = ${v.ntpserver_list}->size();
 		vector<uint32>* rlist = ${v.ntpserver_list};
 
 		for ( int i = 0; i < num_servers; ++i )
 			{
 			uint32 raddr = (*rlist)[i];
-			ntpserver_list->Assign(i, make_intrusive<AddrVal>(htonl(raddr)));
+			ntpserver_list->Assign(i, zeek::make_intrusive<AddrVal>(htonl(raddr)));
 			}
 
 		${context.flow}->options->Assign(28, std::move(ntpserver_list));
@@ -331,7 +331,7 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_vendor_specific_option(v: OptionValue): bool
 		%{
-		${context.flow}->options->Assign(8, make_intrusive<StringVal>(${v.vendor_specific}.length(),
+		${context.flow}->options->Assign(8, zeek::make_intrusive<StringVal>(${v.vendor_specific}.length(),
 		                                                  reinterpret_cast<const char*>(${v.vendor_specific}.begin())));
 
 		return true;
@@ -356,14 +356,14 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_nbns_option(v: OptionValue): bool
 		%{
-		auto server_list = make_intrusive<VectorVal>(zeek::BifType::Vector::DHCP::Addrs);
+		auto server_list = zeek::make_intrusive<VectorVal>(zeek::BifType::Vector::DHCP::Addrs);
 		int num_servers = ${v.nbns}->size();
 		vector<uint32>* rlist = ${v.nbns};
 
 		for ( int i = 0; i < num_servers; ++i )
 			{
 			uint32 raddr = (*rlist)[i];
-			server_list->Assign(i, make_intrusive<AddrVal>(htonl(raddr)));
+			server_list->Assign(i, zeek::make_intrusive<AddrVal>(htonl(raddr)));
 			}
 
 		${context.flow}->options->Assign(9, std::move(server_list));
@@ -389,7 +389,7 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_addr_request_option(v: OptionValue): bool
 		%{
-		${context.flow}->options->Assign(10, make_intrusive<AddrVal>(htonl(${v.addr_request})));
+		${context.flow}->options->Assign(10, zeek::make_intrusive<AddrVal>(htonl(${v.addr_request})));
 
 		return true;
 		%}
@@ -414,7 +414,7 @@ refine flow DHCP_Flow += {
 	function process_lease_option(v: OptionValue): bool
 		%{
 		double lease = static_cast<double>(${v.lease});
-		${context.flow}->options->Assign(11, make_intrusive<IntervalVal>(lease));
+		${context.flow}->options->Assign(11, zeek::make_intrusive<IntervalVal>(lease));
 
 		return true;
 		%}
@@ -438,7 +438,7 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_serv_id_option(v: OptionValue): bool
 		%{
-		${context.flow}->options->Assign(12, make_intrusive<AddrVal>(htonl(${v.serv_addr})));
+		${context.flow}->options->Assign(12, zeek::make_intrusive<AddrVal>(htonl(${v.serv_addr})));
 
 		return true;
 		%}
@@ -462,7 +462,7 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_par_req_list_option(v: OptionValue): bool
 		%{
-		auto params = make_intrusive<VectorVal>(zeek::id::index_vec);
+		auto params = zeek::make_intrusive<VectorVal>(zeek::id::index_vec);
 		int num_parms = ${v.par_req_list}->size();
 		vector<uint8>* plist = ${v.par_req_list};
 
@@ -496,7 +496,7 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_message_option(v: OptionValue): bool
 		%{
-		${context.flow}->options->Assign(14, make_intrusive<StringVal>(${v.message}.length(), 
+		${context.flow}->options->Assign(14, zeek::make_intrusive<StringVal>(${v.message}.length(),
 		                                                   reinterpret_cast<const char*>(${v.message}.begin())));
 
 		return true;
@@ -546,7 +546,7 @@ refine flow DHCP_Flow += {
 	function process_renewal_time_option(v: OptionValue): bool
 		%{
 		double renewal_time = static_cast<double>(${v.renewal_time});
-		${context.flow}->options->Assign(16, make_intrusive<IntervalVal>(renewal_time));
+		${context.flow}->options->Assign(16, zeek::make_intrusive<IntervalVal>(renewal_time));
 
 		return true;
 		%}
@@ -571,7 +571,7 @@ refine flow DHCP_Flow += {
 	function process_rebinding_time_option(v: OptionValue): bool
 		%{
 		double rebinding_time = static_cast<double>(${v.rebinding_time});
-		${context.flow}->options->Assign(17, make_intrusive<IntervalVal>(rebinding_time));
+		${context.flow}->options->Assign(17, zeek::make_intrusive<IntervalVal>(rebinding_time));
 
 		return true;
 		%}
@@ -595,7 +595,7 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_vendor_class_option(v: OptionValue): bool
 		%{
-		${context.flow}->options->Assign(18, make_intrusive<StringVal>(${v.vendor_class}.length(),
+		${context.flow}->options->Assign(18, zeek::make_intrusive<StringVal>(${v.vendor_class}.length(),
 		                                                   reinterpret_cast<const char*>(${v.vendor_class}.begin())));
 
 		return true;
@@ -625,16 +625,16 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_client_id_option(v: OptionValue): bool
 		%{
-		auto client_id = make_intrusive<RecordVal>(zeek::BifType::Record::DHCP::ClientID);
+		auto client_id = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::DHCP::ClientID);
 		client_id->Assign(0, val_mgr->Count(${v.client_id.hwtype}));
-		IntrusivePtr<StringVal> sv;
+		zeek::IntrusivePtr<StringVal> sv;
 
 		if ( ${v.client_id.hwtype} == 0 )
-			sv = make_intrusive<StringVal>(${v.client_id.hwaddr}.length(),
-			                               (const char*)${v.client_id.hwaddr}.begin());
+			sv = zeek::make_intrusive<StringVal>(${v.client_id.hwaddr}.length(),
+			                                     (const char*)${v.client_id.hwaddr}.begin());
 		else
-			sv = make_intrusive<StringVal>(fmt_mac(${v.client_id.hwaddr}.begin(),
-			                               ${v.client_id.hwaddr}.length()));
+			sv = zeek::make_intrusive<StringVal>(fmt_mac(${v.client_id.hwaddr}.begin(),
+			                                     ${v.client_id.hwaddr}.length()));
 
 		client_id->Assign(1, std::move(sv));
 
@@ -662,7 +662,7 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_user_class_option(v: OptionValue): bool
 		%{
-		${context.flow}->options->Assign(20, make_intrusive<StringVal>(${v.user_class}.length(),
+		${context.flow}->options->Assign(20, zeek::make_intrusive<StringVal>(${v.user_class}.length(),
 		                                                   reinterpret_cast<const char*>(${v.user_class}.begin())));
 
 		return true;
@@ -694,12 +694,12 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_client_fqdn_option(v: OptionValue): bool
 		%{
-		auto client_fqdn = make_intrusive<RecordVal>(zeek::BifType::Record::DHCP::ClientFQDN);
+		auto client_fqdn = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::DHCP::ClientFQDN);
 		client_fqdn->Assign(0, val_mgr->Count(${v.client_fqdn.flags}));
 		client_fqdn->Assign(1, val_mgr->Count(${v.client_fqdn.rcode1}));
 		client_fqdn->Assign(2, val_mgr->Count(${v.client_fqdn.rcode2}));
 		const char* domain_name = reinterpret_cast<const char*>(${v.client_fqdn.domain_name}.begin());
-		client_fqdn->Assign(3, make_intrusive<StringVal>(${v.client_fqdn.domain_name}.length(), domain_name));
+		client_fqdn->Assign(3, zeek::make_intrusive<StringVal>(${v.client_fqdn.domain_name}.length(), domain_name));
 
 		${context.flow}->options->Assign(21, std::move(client_fqdn));
 
@@ -752,14 +752,14 @@ refine flow DHCP_Flow += {
 
 	function process_relay_agent_inf_option(v: OptionValue): bool
 		%{
-		auto relay_agent_sub_opt = make_intrusive<VectorVal>(zeek::BifType::Vector::DHCP::SubOpts);
+		auto relay_agent_sub_opt = zeek::make_intrusive<VectorVal>(zeek::BifType::Vector::DHCP::SubOpts);
 
 		uint16 i = 0;
 
 		for ( auto ptrsubopt = ${v.relay_agent_inf}->begin();
 		      ptrsubopt != ${v.relay_agent_inf}->end(); ++ptrsubopt )
 			{
-			auto r = make_intrusive<RecordVal>(zeek::BifType::Record::DHCP::SubOpt);
+			auto r = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::DHCP::SubOpt);
 			r->Assign(0, val_mgr->Count((*ptrsubopt)->code()));
 			r->Assign(1, to_stringval((*ptrsubopt)->value()));
 
@@ -818,7 +818,7 @@ refine flow DHCP_Flow += {
 
 		if ( string_len == 0 )
 			{
-			${context.flow}->options->Assign(24, make_intrusive<StringVal>(0, ""));
+			${context.flow}->options->Assign(24, zeek::make_intrusive<StringVal>(0, ""));
 			return true;
 			}
 
@@ -830,7 +830,7 @@ refine flow DHCP_Flow += {
 		if ( has_newline )
 			--string_len;
 
-		${context.flow}->options->Assign(24, make_intrusive<StringVal>(string_len,
+		${context.flow}->options->Assign(24, zeek::make_intrusive<StringVal>(string_len,
 		                                                   reinterpret_cast<const char*>(${v.auto_proxy_config}.begin())));
 
 		return true;
@@ -840,5 +840,3 @@ refine flow DHCP_Flow += {
 refine typeattr Option += &let {
 	proc_auto_proxy_config_option = $context.flow.process_auto_proxy_config_option(info.value) &if(code==AUTO_PROXY_CONFIG_OPTION);
 };
-
-
diff --git a/src/analyzer/protocol/dns/DNS.cc b/src/analyzer/protocol/dns/DNS.cc
index 1551c9ba4a..9f370155d5 100644
--- a/src/analyzer/protocol/dns/DNS.cc
+++ b/src/analyzer/protocol/dns/DNS.cc
@@ -91,7 +91,7 @@ void DNS_Interpreter::ParseMessage(const u_char* data, int len, int is_query)
 		{ // We did an answer, so can potentially skip auth/addl.
 		static auto dns_skip_auth = zeek::id::find_val<TableVal>("dns_skip_auth");
 		static auto dns_skip_addl = zeek::id::find_val<TableVal>("dns_skip_addl");
-		auto server = make_intrusive<AddrVal>(analyzer->Conn()->RespAddr());
+		auto server = zeek::make_intrusive<AddrVal>(analyzer->Conn()->RespAddr());
 
 		skip_auth = skip_auth || msg.nscount == 0 ||
 				dns_skip_auth->FindOrDefault(server);
@@ -238,7 +238,7 @@ bool DNS_Interpreter::ParseAnswer(DNS_MsgInfo* msg,
 	// Note that the exact meaning of some of these fields will be
 	// re-interpreted by other, more adventurous RR types.
 
-	msg->query_name = make_intrusive<StringVal>(new BroString(name, name_end - name, true));
+	msg->query_name = zeek::make_intrusive<StringVal>(new BroString(name, name_end - name, true));
 	msg->atype = RR_Type(ExtractShort(data, len));
 	msg->aclass = ExtractShort(data, len);
 	msg->ttl = ExtractLong(data, len);
@@ -562,7 +562,7 @@ bool DNS_Interpreter::ParseRR_Name(DNS_MsgInfo* msg,
 			analyzer->ConnVal(),
 			msg->BuildHdrVal(),
 			msg->BuildAnswerVal(),
-			make_intrusive<StringVal>(new BroString(name, name_end - name, true))
+			zeek::make_intrusive<StringVal>(new BroString(name, name_end - name, true))
 		);
 
 	return true;
@@ -603,14 +603,14 @@ bool DNS_Interpreter::ParseRR_SOA(DNS_MsgInfo* msg,
 	if ( dns_SOA_reply && ! msg->skip_event )
 		{
 		static auto dns_soa = zeek::id::find_type<zeek::RecordType>("dns_soa");
-		auto r = make_intrusive<RecordVal>(dns_soa);
-		r->Assign(0, make_intrusive<StringVal>(new BroString(mname, mname_end - mname, true)));
-		r->Assign(1, make_intrusive<StringVal>(new BroString(rname, rname_end - rname, true)));
+		auto r = zeek::make_intrusive<RecordVal>(dns_soa);
+		r->Assign(0, zeek::make_intrusive<StringVal>(new BroString(mname, mname_end - mname, true)));
+		r->Assign(1, zeek::make_intrusive<StringVal>(new BroString(rname, rname_end - rname, true)));
 		r->Assign(2, val_mgr->Count(serial));
-		r->Assign(3, make_intrusive<IntervalVal>(double(refresh), Seconds));
-		r->Assign(4, make_intrusive<IntervalVal>(double(retry), Seconds));
-		r->Assign(5, make_intrusive<IntervalVal>(double(expire), Seconds));
-		r->Assign(6, make_intrusive<IntervalVal>(double(minimum), Seconds));
+		r->Assign(3, zeek::make_intrusive<IntervalVal>(double(refresh), Seconds));
+		r->Assign(4, zeek::make_intrusive<IntervalVal>(double(retry), Seconds));
+		r->Assign(5, zeek::make_intrusive<IntervalVal>(double(expire), Seconds));
+		r->Assign(6, zeek::make_intrusive<IntervalVal>(double(minimum), Seconds));
 
 		analyzer->EnqueueConnEvent(dns_SOA_reply,
 			analyzer->ConnVal(),
@@ -646,7 +646,7 @@ bool DNS_Interpreter::ParseRR_MX(DNS_MsgInfo* msg,
 			analyzer->ConnVal(),
 			msg->BuildHdrVal(),
 			msg->BuildAnswerVal(),
-			make_intrusive<StringVal>(new BroString(name, name_end - name, true)),
+			zeek::make_intrusive<StringVal>(new BroString(name, name_end - name, true)),
 			val_mgr->Count(preference)
 		);
 
@@ -687,7 +687,7 @@ bool DNS_Interpreter::ParseRR_SRV(DNS_MsgInfo* msg,
 			analyzer->ConnVal(),
 			msg->BuildHdrVal(),
 			msg->BuildAnswerVal(),
-			make_intrusive<StringVal>(new BroString(name, name_end - name, true)),
+			zeek::make_intrusive<StringVal>(new BroString(name, name_end - name, true)),
 			val_mgr->Count(priority),
 			val_mgr->Count(weight),
 			val_mgr->Count(port)
@@ -1009,7 +1009,7 @@ bool DNS_Interpreter::ParseRR_NSEC(DNS_MsgInfo* msg,
 
 	int typebitmaps_len = rdlength - (data - data_start);
 
-	auto char_strings = make_intrusive<VectorVal>(zeek::id::string_vec);
+	auto char_strings = zeek::make_intrusive<VectorVal>(zeek::id::string_vec);
 
 	while ( typebitmaps_len > 0 && len > 0 )
 		{
@@ -1024,7 +1024,7 @@ bool DNS_Interpreter::ParseRR_NSEC(DNS_MsgInfo* msg,
 			}
 
 		BroString* bitmap = ExtractStream(data, len, bmlen);
-		char_strings->Assign(char_strings->Size(), make_intrusive<StringVal>(bitmap));
+		char_strings->Assign(char_strings->Size(), zeek::make_intrusive<StringVal>(bitmap));
 		typebitmaps_len = typebitmaps_len - (2 + bmlen);
 		}
 
@@ -1033,7 +1033,7 @@ bool DNS_Interpreter::ParseRR_NSEC(DNS_MsgInfo* msg,
 			analyzer->ConnVal(),
 			msg->BuildHdrVal(),
 			msg->BuildAnswerVal(),
-			make_intrusive<StringVal>(new BroString(name, name_end - name, true)),
+			zeek::make_intrusive<StringVal>(new BroString(name, name_end - name, true)),
 			std::move(char_strings)
 		);
 
@@ -1084,7 +1084,7 @@ bool DNS_Interpreter::ParseRR_NSEC3(DNS_MsgInfo* msg,
 
 	int typebitmaps_len = rdlength - (data - data_start);
 
-	auto char_strings = make_intrusive<VectorVal>(zeek::id::string_vec);
+	auto char_strings = zeek::make_intrusive<VectorVal>(zeek::id::string_vec);
 
 	while ( typebitmaps_len > 0 && len > 0 )
 		{
@@ -1099,7 +1099,7 @@ bool DNS_Interpreter::ParseRR_NSEC3(DNS_MsgInfo* msg,
 			}
 
 		BroString* bitmap = ExtractStream(data, len, bmlen);
-		char_strings->Assign(char_strings->Size(), make_intrusive<StringVal>(bitmap));
+		char_strings->Assign(char_strings->Size(), zeek::make_intrusive<StringVal>(bitmap));
 		typebitmaps_len = typebitmaps_len - (2 + bmlen);
 		}
 
@@ -1200,7 +1200,7 @@ bool DNS_Interpreter::ParseRR_A(DNS_MsgInfo* msg,
 			analyzer->ConnVal(),
 			msg->BuildHdrVal(),
 			msg->BuildAnswerVal(),
-			make_intrusive<AddrVal>(htonl(addr))
+			zeek::make_intrusive<AddrVal>(htonl(addr))
 		);
 
 	return true;
@@ -1236,7 +1236,7 @@ bool DNS_Interpreter::ParseRR_AAAA(DNS_MsgInfo* msg,
 			analyzer->ConnVal(),
 			msg->BuildHdrVal(),
 			msg->BuildAnswerVal(),
-			make_intrusive<AddrVal>(addr)
+			zeek::make_intrusive<AddrVal>(addr)
 		);
 
 	return true;
@@ -1260,7 +1260,7 @@ bool DNS_Interpreter::ParseRR_HINFO(DNS_MsgInfo* msg,
 	return true;
 	}
 
-static IntrusivePtr<StringVal>
+static zeek::IntrusivePtr<StringVal>
 extract_char_string(analyzer::Analyzer* analyzer,
                     const u_char*& data, int& len, int& rdlen)
 	{
@@ -1279,7 +1279,7 @@ extract_char_string(analyzer::Analyzer* analyzer,
 		return nullptr;
 		}
 
-	auto rval = make_intrusive<StringVal>(str_size, reinterpret_cast<const char*>(data));
+	auto rval = zeek::make_intrusive<StringVal>(str_size, reinterpret_cast<const char*>(data));
 
 	rdlen -= str_size;
 	len -= str_size;
@@ -1299,8 +1299,8 @@ bool DNS_Interpreter::ParseRR_TXT(DNS_MsgInfo* msg,
 		return true;
 		}
 
-	auto char_strings = make_intrusive<VectorVal>(zeek::id::string_vec);
-	IntrusivePtr<StringVal> char_string;
+	auto char_strings = zeek::make_intrusive<VectorVal>(zeek::id::string_vec);
+	zeek::IntrusivePtr<StringVal> char_string;
 
 	while ( (char_string = extract_char_string(analyzer, data, len, rdlength)) )
 		char_strings->Assign(char_strings->Size(), std::move(char_string));
@@ -1327,8 +1327,8 @@ bool DNS_Interpreter::ParseRR_SPF(DNS_MsgInfo* msg,
 		return true;
 		}
 
-	auto char_strings = make_intrusive<VectorVal>(zeek::id::string_vec);
-	IntrusivePtr<StringVal> char_string;
+	auto char_strings = zeek::make_intrusive<VectorVal>(zeek::id::string_vec);
+	zeek::IntrusivePtr<StringVal> char_string;
 
 	while ( (char_string = extract_char_string(analyzer, data, len, rdlength)) )
 		char_strings->Assign(char_strings->Size(), std::move(char_string));
@@ -1380,8 +1380,8 @@ bool DNS_Interpreter::ParseRR_CAA(DNS_MsgInfo* msg,
 			msg->BuildHdrVal(),
 			msg->BuildAnswerVal(),
 			val_mgr->Count(flags),
-			make_intrusive<StringVal>(tag),
-			make_intrusive<StringVal>(value)
+			zeek::make_intrusive<StringVal>(tag),
+			zeek::make_intrusive<StringVal>(value)
 		);
 	else
 		{
@@ -1407,10 +1407,10 @@ void DNS_Interpreter::SendReplyOrRejectEvent(DNS_MsgInfo* msg,
 	analyzer->EnqueueConnEvent(event,
 		analyzer->ConnVal(),
 		msg->BuildHdrVal(),
-		make_intrusive<StringVal>(question_name),
+		zeek::make_intrusive<StringVal>(question_name),
 		val_mgr->Count(qtype),
 		val_mgr->Count(qclass),
-		make_intrusive<StringVal>(original_name)
+	    zeek::make_intrusive<StringVal>(original_name)
 	);
 	}
 
@@ -1446,10 +1446,10 @@ DNS_MsgInfo::DNS_MsgInfo(DNS_RawMsgHdr* hdr, int arg_is_query)
 	skip_event = 0;
 	}
 
-IntrusivePtr<RecordVal> DNS_MsgInfo::BuildHdrVal()
+zeek::IntrusivePtr<RecordVal> DNS_MsgInfo::BuildHdrVal()
 	{
 	static auto dns_msg = zeek::id::find_type<zeek::RecordType>("dns_msg");
-	auto r = make_intrusive<RecordVal>(dns_msg);
+	auto r = zeek::make_intrusive<RecordVal>(dns_msg);
 
 	r->Assign(0, val_mgr->Count(id));
 	r->Assign(1, val_mgr->Count(opcode));
@@ -1468,26 +1468,26 @@ IntrusivePtr<RecordVal> DNS_MsgInfo::BuildHdrVal()
 	return r;
 	}
 
-IntrusivePtr<RecordVal> DNS_MsgInfo::BuildAnswerVal()
+zeek::IntrusivePtr<RecordVal> DNS_MsgInfo::BuildAnswerVal()
 	{
 	static auto dns_answer = zeek::id::find_type<zeek::RecordType>("dns_answer");
-	auto r = make_intrusive<RecordVal>(dns_answer);
+	auto r = zeek::make_intrusive<RecordVal>(dns_answer);
 
 	r->Assign(0, val_mgr->Count(int(answer_type)));
 	r->Assign(1, query_name);
 	r->Assign(2, val_mgr->Count(atype));
 	r->Assign(3, val_mgr->Count(aclass));
-	r->Assign(4, make_intrusive<IntervalVal>(double(ttl), Seconds));
+	r->Assign(4, zeek::make_intrusive<IntervalVal>(double(ttl), Seconds));
 
 	return r;
 	}
 
-IntrusivePtr<RecordVal> DNS_MsgInfo::BuildEDNS_Val()
+zeek::IntrusivePtr<RecordVal> DNS_MsgInfo::BuildEDNS_Val()
 	{
 	// We have to treat the additional record type in EDNS differently
 	// than a regular resource record.
 	static auto dns_edns_additional = zeek::id::find_type<zeek::RecordType>("dns_edns_additional");
-	auto r = make_intrusive<RecordVal>(dns_edns_additional);
+	auto r = zeek::make_intrusive<RecordVal>(dns_edns_additional);
 
 	r->Assign(0, val_mgr->Count(int(answer_type)));
 	r->Assign(1, query_name);
@@ -1512,25 +1512,25 @@ IntrusivePtr<RecordVal> DNS_MsgInfo::BuildEDNS_Val()
 	r->Assign(4, val_mgr->Count(return_error));
 	r->Assign(5, val_mgr->Count(version));
 	r->Assign(6, val_mgr->Count(z));
-	r->Assign(7, make_intrusive<IntervalVal>(double(ttl), Seconds));
+	r->Assign(7, zeek::make_intrusive<IntervalVal>(double(ttl), Seconds));
 	r->Assign(8, val_mgr->Count(is_query));
 
 	return r;
 	}
 
-IntrusivePtr<RecordVal> DNS_MsgInfo::BuildTSIG_Val(struct TSIG_DATA* tsig)
+zeek::IntrusivePtr<RecordVal> DNS_MsgInfo::BuildTSIG_Val(struct TSIG_DATA* tsig)
 	{
 	static auto dns_tsig_additional = zeek::id::find_type<zeek::RecordType>("dns_tsig_additional");
-	auto r = make_intrusive<RecordVal>(dns_tsig_additional);
+	auto r = zeek::make_intrusive<RecordVal>(dns_tsig_additional);
 	double rtime = tsig->time_s + tsig->time_ms / 1000.0;
 
 	// r->Assign(0, val_mgr->Count(int(answer_type)));
 	r->Assign(0, query_name);
 	r->Assign(1, val_mgr->Count(int(answer_type)));
-	r->Assign(2, make_intrusive<StringVal>(tsig->alg_name));
-	r->Assign(3, make_intrusive<StringVal>(tsig->sig));
-	r->Assign(4, make_intrusive<TimeVal>(rtime));
-	r->Assign(5, make_intrusive<TimeVal>(double(tsig->fudge)));
+	r->Assign(2, zeek::make_intrusive<StringVal>(tsig->alg_name));
+	r->Assign(3, zeek::make_intrusive<StringVal>(tsig->sig));
+	r->Assign(4, zeek::make_intrusive<TimeVal>(rtime));
+	r->Assign(5, zeek::make_intrusive<TimeVal>(double(tsig->fudge)));
 	r->Assign(6, val_mgr->Count(tsig->orig_id));
 	r->Assign(7, val_mgr->Count(tsig->rr_error));
 	r->Assign(8, val_mgr->Count(is_query));
@@ -1538,47 +1538,47 @@ IntrusivePtr<RecordVal> DNS_MsgInfo::BuildTSIG_Val(struct TSIG_DATA* tsig)
 	return r;
 	}
 
-IntrusivePtr<RecordVal> DNS_MsgInfo::BuildRRSIG_Val(RRSIG_DATA* rrsig)
+zeek::IntrusivePtr<RecordVal> DNS_MsgInfo::BuildRRSIG_Val(RRSIG_DATA* rrsig)
 	{
 	static auto dns_rrsig_rr = zeek::id::find_type<zeek::RecordType>("dns_rrsig_rr");
-	auto r = make_intrusive<RecordVal>(dns_rrsig_rr);
+	auto r = zeek::make_intrusive<RecordVal>(dns_rrsig_rr);
 
 	r->Assign(0, query_name);
 	r->Assign(1, val_mgr->Count(int(answer_type)));
 	r->Assign(2, val_mgr->Count(rrsig->type_covered));
 	r->Assign(3, val_mgr->Count(rrsig->algorithm));
 	r->Assign(4, val_mgr->Count(rrsig->labels));
-	r->Assign(5, make_intrusive<IntervalVal>(double(rrsig->orig_ttl), Seconds));
-	r->Assign(6, make_intrusive<TimeVal>(double(rrsig->sig_exp)));
-	r->Assign(7, make_intrusive<TimeVal>(double(rrsig->sig_incep)));
+	r->Assign(5, zeek::make_intrusive<IntervalVal>(double(rrsig->orig_ttl), Seconds));
+	r->Assign(6, zeek::make_intrusive<TimeVal>(double(rrsig->sig_exp)));
+	r->Assign(7, zeek::make_intrusive<TimeVal>(double(rrsig->sig_incep)));
 	r->Assign(8, val_mgr->Count(rrsig->key_tag));
-	r->Assign(9, make_intrusive<StringVal>(rrsig->signer_name));
-	r->Assign(10, make_intrusive<StringVal>(rrsig->signature));
+	r->Assign(9, zeek::make_intrusive<StringVal>(rrsig->signer_name));
+	r->Assign(10, zeek::make_intrusive<StringVal>(rrsig->signature));
 	r->Assign(11, val_mgr->Count(is_query));
 
 	return r;
 	}
 
-IntrusivePtr<RecordVal> DNS_MsgInfo::BuildDNSKEY_Val(DNSKEY_DATA* dnskey)
+zeek::IntrusivePtr<RecordVal> DNS_MsgInfo::BuildDNSKEY_Val(DNSKEY_DATA* dnskey)
 	{
 	static auto dns_dnskey_rr = zeek::id::find_type<zeek::RecordType>("dns_dnskey_rr");
-	auto r = make_intrusive<RecordVal>(dns_dnskey_rr);
+	auto r = zeek::make_intrusive<RecordVal>(dns_dnskey_rr);
 
 	r->Assign(0, query_name);
 	r->Assign(1, val_mgr->Count(int(answer_type)));
 	r->Assign(2, val_mgr->Count(dnskey->dflags));
 	r->Assign(3, val_mgr->Count(dnskey->dprotocol));
 	r->Assign(4, val_mgr->Count(dnskey->dalgorithm));
-	r->Assign(5, make_intrusive<StringVal>(dnskey->public_key));
+	r->Assign(5, zeek::make_intrusive<StringVal>(dnskey->public_key));
 	r->Assign(6, val_mgr->Count(is_query));
 
 	return r;
 	}
 
-IntrusivePtr<RecordVal> DNS_MsgInfo::BuildNSEC3_Val(NSEC3_DATA* nsec3)
+zeek::IntrusivePtr<RecordVal> DNS_MsgInfo::BuildNSEC3_Val(NSEC3_DATA* nsec3)
 	{
 	static auto dns_nsec3_rr = zeek::id::find_type<zeek::RecordType>("dns_nsec3_rr");
-	auto r = make_intrusive<RecordVal>(dns_nsec3_rr);
+	auto r = zeek::make_intrusive<RecordVal>(dns_nsec3_rr);
 
 	r->Assign(0, query_name);
 	r->Assign(1, val_mgr->Count(int(answer_type)));
@@ -1586,26 +1586,26 @@ IntrusivePtr<RecordVal> DNS_MsgInfo::BuildNSEC3_Val(NSEC3_DATA* nsec3)
 	r->Assign(3, val_mgr->Count(nsec3->nsec_hash_algo));
 	r->Assign(4, val_mgr->Count(nsec3->nsec_iter));
 	r->Assign(5, val_mgr->Count(nsec3->nsec_salt_len));
-	r->Assign(6, make_intrusive<StringVal>(nsec3->nsec_salt));
+	r->Assign(6, zeek::make_intrusive<StringVal>(nsec3->nsec_salt));
 	r->Assign(7, val_mgr->Count(nsec3->nsec_hlen));
-	r->Assign(8, make_intrusive<StringVal>(nsec3->nsec_hash));
+	r->Assign(8, zeek::make_intrusive<StringVal>(nsec3->nsec_hash));
 	r->Assign(9, std::move(nsec3->bitmaps));
 	r->Assign(10, val_mgr->Count(is_query));
 
 	return r;
 	}
 
-IntrusivePtr<RecordVal> DNS_MsgInfo::BuildDS_Val(DS_DATA* ds)
+zeek::IntrusivePtr<RecordVal> DNS_MsgInfo::BuildDS_Val(DS_DATA* ds)
 	{
 	static auto dns_ds_rr = zeek::id::find_type<zeek::RecordType>("dns_ds_rr");
-	auto r = make_intrusive<RecordVal>(dns_ds_rr);
+	auto r = zeek::make_intrusive<RecordVal>(dns_ds_rr);
 
 	r->Assign(0, query_name);
 	r->Assign(1, val_mgr->Count(int(answer_type)));
 	r->Assign(2, val_mgr->Count(ds->key_tag));
 	r->Assign(3, val_mgr->Count(ds->algorithm));
 	r->Assign(4, val_mgr->Count(ds->digest_type));
-	r->Assign(5, make_intrusive<StringVal>(ds->digest_val));
+	r->Assign(5, zeek::make_intrusive<StringVal>(ds->digest_val));
 	r->Assign(6, val_mgr->Count(is_query));
 
 	return r;
diff --git a/src/analyzer/protocol/dns/DNS.h b/src/analyzer/protocol/dns/DNS.h
index 040a1c000d..63787b9da1 100644
--- a/src/analyzer/protocol/dns/DNS.h
+++ b/src/analyzer/protocol/dns/DNS.h
@@ -165,7 +165,7 @@ struct NSEC3_DATA {
 	BroString* nsec_salt;
 	unsigned short nsec_hlen;
 	BroString* nsec_hash;
-	IntrusivePtr<VectorVal> bitmaps;
+	zeek::IntrusivePtr<VectorVal> bitmaps;
 };
 
 struct DS_DATA {
@@ -179,14 +179,14 @@ class DNS_MsgInfo {
 public:
 	DNS_MsgInfo(DNS_RawMsgHdr* hdr, int is_query);
 
-	IntrusivePtr<RecordVal> BuildHdrVal();
-	IntrusivePtr<RecordVal> BuildAnswerVal();
-	IntrusivePtr<RecordVal> BuildEDNS_Val();
-	IntrusivePtr<RecordVal> BuildTSIG_Val(struct TSIG_DATA*);
-	IntrusivePtr<RecordVal> BuildRRSIG_Val(struct RRSIG_DATA*);
-	IntrusivePtr<RecordVal> BuildDNSKEY_Val(struct DNSKEY_DATA*);
-	IntrusivePtr<RecordVal> BuildNSEC3_Val(struct NSEC3_DATA*);
-	IntrusivePtr<RecordVal> BuildDS_Val(struct DS_DATA*);
+	zeek::IntrusivePtr<RecordVal> BuildHdrVal();
+	zeek::IntrusivePtr<RecordVal> BuildAnswerVal();
+	zeek::IntrusivePtr<RecordVal> BuildEDNS_Val();
+	zeek::IntrusivePtr<RecordVal> BuildTSIG_Val(struct TSIG_DATA*);
+	zeek::IntrusivePtr<RecordVal> BuildRRSIG_Val(struct RRSIG_DATA*);
+	zeek::IntrusivePtr<RecordVal> BuildDNSKEY_Val(struct DNSKEY_DATA*);
+	zeek::IntrusivePtr<RecordVal> BuildNSEC3_Val(struct NSEC3_DATA*);
+	zeek::IntrusivePtr<RecordVal> BuildDS_Val(struct DS_DATA*);
 
 	int id;
 	int opcode;	///< query type, see DNS_Opcode
@@ -203,7 +203,7 @@ public:
 	int arcount;	///< number of additional RRs
 	int is_query;	///< whether it came from the session initiator
 
-	IntrusivePtr<StringVal> query_name;
+	zeek::IntrusivePtr<StringVal> query_name;
 	RR_Type atype;
 	int aclass;	///< normally = 1, inet
 	uint32_t ttl;
diff --git a/src/analyzer/protocol/file/File.cc b/src/analyzer/protocol/file/File.cc
index 7bb91df028..f43f00df95 100644
--- a/src/analyzer/protocol/file/File.cc
+++ b/src/analyzer/protocol/file/File.cc
@@ -79,10 +79,11 @@ void File_Analyzer::Identify()
 	                               : *(matches.begin()->second.begin());
 
 	if ( file_transferred )
-		EnqueueConnEvent(file_transferred,
+		EnqueueConnEvent(
+			file_transferred,
 			ConnVal(),
-			make_intrusive<StringVal>(buffer_len, buffer),
-			make_intrusive<StringVal>("<unknown>"),
-			make_intrusive<StringVal>(match)
+			zeek::make_intrusive<StringVal>(buffer_len, buffer),
+			zeek::make_intrusive<StringVal>("<unknown>"),
+			zeek::make_intrusive<StringVal>(match)
 		);
 	}
diff --git a/src/analyzer/protocol/finger/Finger.cc b/src/analyzer/protocol/finger/Finger.cc
index 2d96eabe1a..faf19582e3 100644
--- a/src/analyzer/protocol/finger/Finger.cc
+++ b/src/analyzer/protocol/finger/Finger.cc
@@ -70,8 +70,8 @@ void Finger_Analyzer::DeliverStream(int length, const u_char* data, bool is_orig
 			EnqueueConnEvent(finger_request,
 				ConnVal(),
 				val_mgr->Bool(long_cnt),
-				make_intrusive<StringVal>(at - line, line),
-				make_intrusive<StringVal>(end_of_line - host, host)
+				zeek::make_intrusive<StringVal>(at - line, line),
+				zeek::make_intrusive<StringVal>(end_of_line - host, host)
 			);
 
 		Conn()->Match(Rule::FINGER, (const u_char *) line,
@@ -87,7 +87,7 @@ void Finger_Analyzer::DeliverStream(int length, const u_char* data, bool is_orig
 
 		EnqueueConnEvent(finger_reply,
 			ConnVal(),
-			make_intrusive<StringVal>(end_of_line - line, line)
+			zeek::make_intrusive<StringVal>(end_of_line - line, line)
 		);
 		}
 	}
diff --git a/src/analyzer/protocol/ftp/FTP.cc b/src/analyzer/protocol/ftp/FTP.cc
index 9fcaaf3d73..d2b00b7ee7 100644
--- a/src/analyzer/protocol/ftp/FTP.cc
+++ b/src/analyzer/protocol/ftp/FTP.cc
@@ -98,8 +98,8 @@ void FTP_Analyzer::DeliverStream(int length, const u_char* data, bool orig)
 
 		vl = {
 			ConnVal(),
-			IntrusivePtr{AdoptRef{}, cmd_str},
-			make_intrusive<StringVal>(end_of_line - line, line),
+			zeek::IntrusivePtr{zeek::AdoptRef{}, cmd_str},
+			zeek::make_intrusive<StringVal>(end_of_line - line, line),
 		};
 
 		f = ftp_request;
@@ -178,7 +178,7 @@ void FTP_Analyzer::DeliverStream(int length, const u_char* data, bool orig)
 		vl = {
 			ConnVal(),
 			val_mgr->Count(reply_code),
-			make_intrusive<StringVal>(end_of_line - line, line),
+			zeek::make_intrusive<StringVal>(end_of_line - line, line),
 			val_mgr->Bool(cont_resp)
 		};
 
diff --git a/src/analyzer/protocol/ftp/functions.bif b/src/analyzer/protocol/ftp/functions.bif
index 204481b575..aa6557baac 100644
--- a/src/analyzer/protocol/ftp/functions.bif
+++ b/src/analyzer/protocol/ftp/functions.bif
@@ -4,9 +4,9 @@ type ftp_port: record;
 %%{
 #include "Reporter.h"
 
-static IntrusivePtr<Val> parse_port(const char* line)
+static zeek::IntrusivePtr<Val> parse_port(const char* line)
 	{
-	auto r = make_intrusive<RecordVal>(zeek::BifType::Record::ftp_port);
+	auto r = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::ftp_port);
 
 	int bytes[6];
 	if ( line && sscanf(line, "%d,%d,%d,%d,%d,%d",
@@ -33,13 +33,13 @@ static IntrusivePtr<Val> parse_port(const char* line)
 			good = 0;
 			}
 
-		r->Assign(0, make_intrusive<AddrVal>(htonl(addr)));
+		r->Assign(0, zeek::make_intrusive<AddrVal>(htonl(addr)));
 		r->Assign(1, val_mgr->Port(port, TRANSPORT_TCP));
 		r->Assign(2, val_mgr->Bool(good));
 		}
 	else
 		{
-		r->Assign(0, make_intrusive<AddrVal>(uint32_t(0)));
+		r->Assign(0, zeek::make_intrusive<AddrVal>(uint32_t(0)));
 		r->Assign(1, val_mgr->Port(0, TRANSPORT_TCP));
 		r->Assign(2, val_mgr->False());
 		}
@@ -47,9 +47,9 @@ static IntrusivePtr<Val> parse_port(const char* line)
 	return r;
 	}
 
-static IntrusivePtr<Val> parse_eftp(const char* line)
+static zeek::IntrusivePtr<Val> parse_eftp(const char* line)
 	{
-	auto r = make_intrusive<RecordVal>(zeek::BifType::Record::ftp_port);
+	auto r = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::ftp_port);
 
 	int net_proto = 0;	// currently not used
 	IPAddr addr;	// unspecified IPv6 address (all 128 bits zero)
@@ -109,7 +109,7 @@ static IntrusivePtr<Val> parse_eftp(const char* line)
 
 		}
 
-	r->Assign(0, make_intrusive<AddrVal>(addr));
+	r->Assign(0, zeek::make_intrusive<AddrVal>(addr));
 	r->Assign(1, val_mgr->Port(port, TRANSPORT_TCP));
 	r->Assign(2, val_mgr->Bool(good));
 
@@ -206,10 +206,10 @@ function fmt_ftp_port%(a: addr, p: port%): string
 		{
 		uint32_t a = ntohl(addr[0]);
 		uint32_t pn = p->Port();
-		return make_intrusive<StringVal>(fmt("%d,%d,%d,%d,%d,%d",
-						a >> 24, (a >> 16) & 0xff,
-						(a >> 8) & 0xff, a & 0xff,
-						pn >> 8, pn & 0xff));
+		return zeek::make_intrusive<StringVal>(fmt("%d,%d,%d,%d,%d,%d",
+		                                           a >> 24, (a >> 16) & 0xff,
+		                                           (a >> 8) & 0xff, a & 0xff,
+		                                           pn >> 8, pn & 0xff));
 		}
 	else
 		{
diff --git a/src/analyzer/protocol/gnutella/Gnutella.cc b/src/analyzer/protocol/gnutella/Gnutella.cc
index 6b2d487c9a..940b7692c1 100644
--- a/src/analyzer/protocol/gnutella/Gnutella.cc
+++ b/src/analyzer/protocol/gnutella/Gnutella.cc
@@ -73,7 +73,7 @@ void Gnutella_Analyzer::Done()
 			if ( ! p->msg_sent && p->msg_pos )
 				EnqueueConnEvent(gnutella_partial_binary_msg,
 					ConnVal(),
-					make_intrusive<StringVal>(p->msg),
+					zeek::make_intrusive<StringVal>(p->msg),
 					val_mgr->Bool((i == 0)),
 					val_mgr->Count(p->msg_pos)
 				);
@@ -179,7 +179,7 @@ void Gnutella_Analyzer::DeliverLines(int len, const u_char* data, bool orig)
 				EnqueueConnEvent(gnutella_text_msg,
 					ConnVal(),
 					val_mgr->Bool(orig),
-					make_intrusive<StringVal>(ms->headers.data())
+					zeek::make_intrusive<StringVal>(ms->headers.data())
 				);
 
 			ms->headers = "";
@@ -221,7 +221,7 @@ void Gnutella_Analyzer::SendEvents(GnutellaMsgState* p, bool is_orig)
 			val_mgr->Count(p->msg_ttl),
 			val_mgr->Count(p->msg_hops),
 			val_mgr->Count(p->msg_len),
-			make_intrusive<StringVal>(p->payload),
+			zeek::make_intrusive<StringVal>(p->payload),
 			val_mgr->Count(p->payload_len),
 			val_mgr->Bool((p->payload_len < std::min(p->msg_len, (unsigned int)GNUTELLA_MAX_PAYLOAD))),
 			val_mgr->Bool((p->payload_left == 0))
diff --git a/src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac b/src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac
index 00eae1b5f1..24168e79ff 100644
--- a/src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac
+++ b/src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac
@@ -4,9 +4,9 @@
 %}
 
 %code{
-IntrusivePtr<RecordVal> BuildGTPv1Hdr(const GTPv1_Header* pdu)
+zeek::IntrusivePtr<RecordVal> BuildGTPv1Hdr(const GTPv1_Header* pdu)
 	{
-	auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::gtpv1_hdr);
+	auto rv = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::gtpv1_hdr);
 
 	rv->Assign(0, val_mgr->Count(pdu->version()));
 	rv->Assign(1, val_mgr->Bool(pdu->pt_flag()));
@@ -28,14 +28,14 @@ IntrusivePtr<RecordVal> BuildGTPv1Hdr(const GTPv1_Header* pdu)
 	return rv;
 	}
 
-static IntrusivePtr<Val> BuildIMSI(const InformationElement* ie)
+static zeek::IntrusivePtr<Val> BuildIMSI(const InformationElement* ie)
 	{
 	return val_mgr->Count(ie->imsi()->value());
 	}
 
-static IntrusivePtr<Val> BuildRAI(const InformationElement* ie)
+static zeek::IntrusivePtr<Val> BuildRAI(const InformationElement* ie)
 	{
-	auto ev = make_intrusive<RecordVal>(zeek::BifType::Record::gtp_rai);
+	auto ev = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::gtp_rai);
 	ev->Assign(0, val_mgr->Count(ie->rai()->mcc()));
 	ev->Assign(1, val_mgr->Count(ie->rai()->mnc()));
 	ev->Assign(2, val_mgr->Count(ie->rai()->lac()));
@@ -43,49 +43,49 @@ static IntrusivePtr<Val> BuildRAI(const InformationElement* ie)
 	return ev;
 	}
 
-static IntrusivePtr<Val> BuildRecovery(const InformationElement* ie)
+static zeek::IntrusivePtr<Val> BuildRecovery(const InformationElement* ie)
 	{
 	return val_mgr->Count(ie->recovery()->restart_counter());
 	}
 
-static IntrusivePtr<Val> BuildSelectionMode(const InformationElement* ie)
+static zeek::IntrusivePtr<Val> BuildSelectionMode(const InformationElement* ie)
 	{
 	return val_mgr->Count(ie->selection_mode()->mode());
 	}
 
-static IntrusivePtr<Val> BuildTEID1(const InformationElement* ie)
+static zeek::IntrusivePtr<Val> BuildTEID1(const InformationElement* ie)
 	{
 	return val_mgr->Count(ie->teid1()->value());
 	}
 
-static IntrusivePtr<Val> BuildTEID_ControlPlane(const InformationElement* ie)
+static zeek::IntrusivePtr<Val> BuildTEID_ControlPlane(const InformationElement* ie)
 	{
 	return val_mgr->Count(ie->teidcp()->value());
 	}
 
-static IntrusivePtr<Val> BuildNSAPI(const InformationElement* ie)
+static zeek::IntrusivePtr<Val> BuildNSAPI(const InformationElement* ie)
 	{
 	return val_mgr->Count(ie->nsapi()->nsapi());
 	}
 
-static IntrusivePtr<Val> BuildChargingCharacteristics(const InformationElement* ie)
+static zeek::IntrusivePtr<Val> BuildChargingCharacteristics(const InformationElement* ie)
 	{
 	return val_mgr->Count(ie->charging_characteristics()->value());
 	}
 
-static IntrusivePtr<Val> BuildTraceReference(const InformationElement* ie)
+static zeek::IntrusivePtr<Val> BuildTraceReference(const InformationElement* ie)
 	{
 	return val_mgr->Count(ie->trace_reference()->value());
 	}
 
-static IntrusivePtr<Val> BuildTraceType(const InformationElement* ie)
+static zeek::IntrusivePtr<Val> BuildTraceType(const InformationElement* ie)
 	{
 	return val_mgr->Count(ie->trace_type()->value());
 	}
 
-IntrusivePtr<Val> BuildEndUserAddr(const InformationElement* ie)
+zeek::IntrusivePtr<Val> BuildEndUserAddr(const InformationElement* ie)
 	{
-	auto ev = make_intrusive<RecordVal>(zeek::BifType::Record::gtp_end_user_addr);
+	auto ev = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::gtp_end_user_addr);
 	ev->Assign(0, val_mgr->Count(ie->end_user_addr()->pdp_type_org()));
 	ev->Assign(1, val_mgr->Count(ie->end_user_addr()->pdp_type_num()));
 
@@ -97,15 +97,15 @@ IntrusivePtr<Val> BuildEndUserAddr(const InformationElement* ie)
 
 		switch ( ie->end_user_addr()->pdp_type_num() ) {
 		case 0x21:
-			ev->Assign(2, make_intrusive<AddrVal>(
+			ev->Assign(2, zeek::make_intrusive<AddrVal>(
 			  IPAddr(IPv4, (const uint32*) d, IPAddr::Network)));
 			break;
 		case 0x57:
-			ev->Assign(2, make_intrusive<AddrVal>(
+			ev->Assign(2, zeek::make_intrusive<AddrVal>(
 			  IPAddr(IPv6, (const uint32*) d, IPAddr::Network)));
 			break;
 		default:
-			ev->Assign(3, make_intrusive<StringVal>(
+			ev->Assign(3, zeek::make_intrusive<StringVal>(
 			  new BroString((const u_char*) d, len, false)));
 			break;
 		}
@@ -114,121 +114,121 @@ IntrusivePtr<Val> BuildEndUserAddr(const InformationElement* ie)
 	return ev;
 	}
 
-IntrusivePtr<Val> BuildAccessPointName(const InformationElement* ie)
+zeek::IntrusivePtr<Val> BuildAccessPointName(const InformationElement* ie)
 	{
 	BroString* bs = new BroString((const u_char*) ie->ap_name()->value().data(),
 	                              ie->ap_name()->value().length(), false);
-	return make_intrusive<StringVal>(bs);
+	return zeek::make_intrusive<StringVal>(bs);
 	}
 
-IntrusivePtr<Val> BuildProtoConfigOptions(const InformationElement* ie)
+zeek::IntrusivePtr<Val> BuildProtoConfigOptions(const InformationElement* ie)
 	{
 	const u_char* d = (const u_char*) ie->proto_config_opts()->value().data();
 	int len = ie->proto_config_opts()->value().length();
-	return make_intrusive<StringVal>(new BroString(d, len, false));
+	return zeek::make_intrusive<StringVal>(new BroString(d, len, false));
 	}
 
-IntrusivePtr<Val> BuildGSN_Addr(const InformationElement* ie)
+zeek::IntrusivePtr<Val> BuildGSN_Addr(const InformationElement* ie)
 	{
-	auto ev = make_intrusive<RecordVal>(zeek::BifType::Record::gtp_gsn_addr);
+	auto ev = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::gtp_gsn_addr);
 
 	int len = ie->gsn_addr()->value().length();
 	const uint8* d = ie->gsn_addr()->value().data();
 
 	if ( len == 4 )
-		ev->Assign(0, make_intrusive<AddrVal>(
+		ev->Assign(0, zeek::make_intrusive<AddrVal>(
 		  IPAddr(IPv4, (const uint32*) d, IPAddr::Network)));
 	else if ( len == 16 )
-		ev->Assign(0, make_intrusive<AddrVal>(
+		ev->Assign(0, zeek::make_intrusive<AddrVal>(
 		  IPAddr(IPv6, (const uint32*) d, IPAddr::Network)));
 	else
-		ev->Assign(1, make_intrusive<StringVal>(new BroString((const u_char*) d, len, false)));
+		ev->Assign(1, zeek::make_intrusive<StringVal>(new BroString((const u_char*) d, len, false)));
 
 	return ev;
 	}
 
-IntrusivePtr<Val> BuildMSISDN(const InformationElement* ie)
+zeek::IntrusivePtr<Val> BuildMSISDN(const InformationElement* ie)
 	{
 	const u_char* d = (const u_char*) ie->msisdn()->value().data();
 	int len = ie->msisdn()->value().length();
-	return make_intrusive<StringVal>(new BroString(d, len, false));
+	return zeek::make_intrusive<StringVal>(new BroString(d, len, false));
 	}
 
-IntrusivePtr<Val> BuildQoS_Profile(const InformationElement* ie)
+zeek::IntrusivePtr<Val> BuildQoS_Profile(const InformationElement* ie)
 	{
-	auto ev = make_intrusive<RecordVal>(zeek::BifType::Record::gtp_qos_profile);
+	auto ev = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::gtp_qos_profile);
 
 	const u_char* d = (const u_char*) ie->qos_profile()->data().data();
 	int len = ie->qos_profile()->data().length();
 
 	ev->Assign(0, val_mgr->Count(ie->qos_profile()->alloc_retention_priority()));
-	ev->Assign(1, make_intrusive<StringVal>(new BroString(d, len, false)));
+	ev->Assign(1, zeek::make_intrusive<StringVal>(new BroString(d, len, false)));
 
 	return ev;
 	}
 
-IntrusivePtr<Val> BuildTrafficFlowTemplate(const InformationElement* ie)
+zeek::IntrusivePtr<Val> BuildTrafficFlowTemplate(const InformationElement* ie)
 	{
 	const uint8* d = ie->traffic_flow_template()->value().data();
 	int len = ie->traffic_flow_template()->value().length();
-	return make_intrusive<StringVal>(new BroString((const u_char*) d, len, false));
+	return zeek::make_intrusive<StringVal>(new BroString((const u_char*) d, len, false));
 	}
 
-IntrusivePtr<Val> BuildTriggerID(const InformationElement* ie)
+zeek::IntrusivePtr<Val> BuildTriggerID(const InformationElement* ie)
 	{
 	const uint8* d = ie->trigger_id()->value().data();
 	int len = ie->trigger_id()->value().length();
-	return make_intrusive<StringVal>(new BroString((const u_char*) d, len, false));
+	return zeek::make_intrusive<StringVal>(new BroString((const u_char*) d, len, false));
 	}
 
-IntrusivePtr<Val> BuildOMC_ID(const InformationElement* ie)
+zeek::IntrusivePtr<Val> BuildOMC_ID(const InformationElement* ie)
 	{
 	const uint8* d = ie->omc_id()->value().data();
 	int len = ie->omc_id()->value().length();
-	return make_intrusive<StringVal>(new BroString((const u_char*) d, len, false));
+	return zeek::make_intrusive<StringVal>(new BroString((const u_char*) d, len, false));
 	}
 
-IntrusivePtr<Val> BuildPrivateExt(const InformationElement* ie)
+zeek::IntrusivePtr<Val> BuildPrivateExt(const InformationElement* ie)
 	{
-	auto ev = make_intrusive<RecordVal>(zeek::BifType::Record::gtp_private_extension);
+	auto ev = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::gtp_private_extension);
 
 	const uint8* d = ie->private_ext()->value().data();
 	int len = ie->private_ext()->value().length();
 
 	ev->Assign(0, val_mgr->Count(ie->private_ext()->id()));
-	ev->Assign(1, make_intrusive<StringVal>(new BroString((const u_char*) d, len, false)));
+	ev->Assign(1, zeek::make_intrusive<StringVal>(new BroString((const u_char*) d, len, false)));
 
 	return ev;
 	}
 
-static IntrusivePtr<Val> BuildCause(const InformationElement* ie)
+static zeek::IntrusivePtr<Val> BuildCause(const InformationElement* ie)
 	{
 	return val_mgr->Count(ie->cause()->value());
 	}
 
-static IntrusivePtr<Val> BuildReorderReq(const InformationElement* ie)
+static zeek::IntrusivePtr<Val> BuildReorderReq(const InformationElement* ie)
 	{
 	return val_mgr->Bool(ie->reorder_req()->req());
 	}
 
-static IntrusivePtr<Val> BuildChargingID(const InformationElement* ie)
+static zeek::IntrusivePtr<Val> BuildChargingID(const InformationElement* ie)
 	{
 	return val_mgr->Count(ie->charging_id()->value());;
 	}
 
-IntrusivePtr<Val> BuildChargingGatewayAddr(const InformationElement* ie)
+zeek::IntrusivePtr<Val> BuildChargingGatewayAddr(const InformationElement* ie)
 	{
 	const uint8* d = ie->charging_gateway_addr()->value().data();
 	int len = ie->charging_gateway_addr()->value().length();
 	if ( len == 4 )
-		return make_intrusive<AddrVal>(IPAddr(IPv4, (const uint32*) d, IPAddr::Network));
+		return zeek::make_intrusive<AddrVal>(IPAddr(IPv4, (const uint32*) d, IPAddr::Network));
 	else if ( len == 16 )
-		return make_intrusive<AddrVal>(IPAddr(IPv6, (const uint32*) d, IPAddr::Network));
+		return zeek::make_intrusive<AddrVal>(IPAddr(IPv6, (const uint32*) d, IPAddr::Network));
 	else
 		return nullptr;
 	}
 
-static IntrusivePtr<Val> BuildTeardownInd(const InformationElement* ie)
+static zeek::IntrusivePtr<Val> BuildTeardownInd(const InformationElement* ie)
 	{
 	return val_mgr->Bool(ie->teardown_ind()->ind());
 	}
@@ -237,7 +237,7 @@ void CreatePDP_Request(const BroAnalyzer& a, const GTPv1_Header* pdu)
 	{
 	if ( ! ::gtpv1_create_pdp_ctx_request ) return;
 
-	auto rv = make_intrusive<RecordVal>(
+	auto rv = zeek::make_intrusive<RecordVal>(
 	  zeek::BifType::Record::gtp_create_pdp_ctx_request_elements);
 
 	const vector<InformationElement *> * v = pdu->create_pdp_ctx_request();
@@ -337,7 +337,7 @@ void CreatePDP_Response(const BroAnalyzer& a, const GTPv1_Header* pdu)
 	if ( ! ::gtpv1_create_pdp_ctx_response )
 	    return;
 
-	auto rv = make_intrusive<RecordVal>(
+	auto rv = zeek::make_intrusive<RecordVal>(
 	  zeek::BifType::Record::gtp_create_pdp_ctx_response_elements);
 
 	const vector<InformationElement *> * v = pdu->create_pdp_ctx_response();
@@ -406,7 +406,7 @@ void UpdatePDP_Request(const BroAnalyzer& a, const GTPv1_Header* pdu)
 	if ( ! ::gtpv1_update_pdp_ctx_request )
 	    return;
 
-	auto rv = make_intrusive<RecordVal>(
+	auto rv = zeek::make_intrusive<RecordVal>(
 	  zeek::BifType::Record::gtp_update_pdp_ctx_request_elements);
 
 	const vector<InformationElement *> * v = pdu->update_pdp_ctx_request();
@@ -484,7 +484,7 @@ void UpdatePDP_Response(const BroAnalyzer& a, const GTPv1_Header* pdu)
 	if ( ! ::gtpv1_update_pdp_ctx_response )
 	    return;
 
-	auto rv = make_intrusive<RecordVal>(
+	auto rv = zeek::make_intrusive<RecordVal>(
 	  zeek::BifType::Record::gtp_update_pdp_ctx_response_elements);
 
 	const vector<InformationElement *> * v = pdu->update_pdp_ctx_response();
@@ -544,7 +544,7 @@ void DeletePDP_Request(const BroAnalyzer& a, const GTPv1_Header* pdu)
 	if ( ! ::gtpv1_delete_pdp_ctx_request )
 	    return;
 
-	auto rv = make_intrusive<RecordVal>(
+	auto rv = zeek::make_intrusive<RecordVal>(
 	  zeek::BifType::Record::gtp_delete_pdp_ctx_request_elements);
 
 	const vector<InformationElement *> * v = pdu->delete_pdp_ctx_request();
@@ -578,7 +578,7 @@ void DeletePDP_Response(const BroAnalyzer& a, const GTPv1_Header* pdu)
 	if ( ! ::gtpv1_delete_pdp_ctx_response )
 	    return;
 
-	auto rv = make_intrusive<RecordVal>(
+	auto rv = zeek::make_intrusive<RecordVal>(
 	  zeek::BifType::Record::gtp_delete_pdp_ctx_response_elements);
 
 	const vector<InformationElement *> * v = pdu->delete_pdp_ctx_response();
diff --git a/src/analyzer/protocol/http/HTTP.cc b/src/analyzer/protocol/http/HTTP.cc
index a4e4d2befe..cd2865cc60 100644
--- a/src/analyzer/protocol/http/HTTP.cc
+++ b/src/analyzer/protocol/http/HTTP.cc
@@ -613,14 +613,14 @@ HTTP_Message::~HTTP_Message()
 	delete [] entity_data_buffer;
 	}
 
-IntrusivePtr<RecordVal> HTTP_Message::BuildMessageStat(bool interrupted, const char* msg)
+zeek::IntrusivePtr<RecordVal> HTTP_Message::BuildMessageStat(bool interrupted, const char* msg)
 	{
 	static auto http_message_stat = zeek::id::find_type<zeek::RecordType>("http_message_stat");
-	auto stat = make_intrusive<RecordVal>(http_message_stat);
+	auto stat = zeek::make_intrusive<RecordVal>(http_message_stat);
 	int field = 0;
-	stat->Assign(field++, make_intrusive<TimeVal>(start_time));
+	stat->Assign(field++, zeek::make_intrusive<TimeVal>(start_time));
 	stat->Assign(field++, val_mgr->Bool(interrupted));
-	stat->Assign(field++, make_intrusive<StringVal>(msg));
+	stat->Assign(field++, zeek::make_intrusive<StringVal>(msg));
 	stat->Assign(field++, val_mgr->Count(body_length));
 	stat->Assign(field++, val_mgr->Count(content_gap_length));
 	stat->Assign(field++, val_mgr->Count(header_length));
@@ -1153,11 +1153,11 @@ void HTTP_Analyzer::GenStats()
 	if ( http_stats )
 		{
 		static auto http_stats_rec = zeek::id::find_type<zeek::RecordType>("http_stats_rec");
-		auto r = make_intrusive<RecordVal>(http_stats_rec);
+		auto r = zeek::make_intrusive<RecordVal>(http_stats_rec);
 		r->Assign(0, val_mgr->Count(num_requests));
 		r->Assign(1, val_mgr->Count(num_replies));
-		r->Assign(2, make_intrusive<DoubleVal>(request_version.ToDouble()));
-		r->Assign(3, make_intrusive<DoubleVal>(reply_version.ToDouble()));
+		r->Assign(2, zeek::make_intrusive<DoubleVal>(request_version.ToDouble()));
+		r->Assign(3, zeek::make_intrusive<DoubleVal>(reply_version.ToDouble()));
 
 		// DEBUG_MSG("%.6f http_stats\n", network_time);
 		EnqueueConnEvent(http_stats, ConnVal(), std::move(r));
@@ -1242,7 +1242,7 @@ int HTTP_Analyzer::HTTP_RequestLine(const char* line, const char* end_of_line)
 		return -1;
 		}
 
-	request_method = make_intrusive<StringVal>(end_of_method - line, line);
+	request_method = zeek::make_intrusive<StringVal>(end_of_method - line, line);
 
 	Conn()->Match(Rule::HTTP_REQUEST,
 			(const u_char*) unescaped_URI->AsString()->Bytes(),
@@ -1312,8 +1312,8 @@ bool HTTP_Analyzer::ParseRequest(const char* line, const char* end_of_line)
 
 	// NormalizeURI(line, end_of_uri);
 
-	request_URI = make_intrusive<StringVal>(end_of_uri - line, line);
-	unescaped_URI = make_intrusive<StringVal>(
+	request_URI = zeek::make_intrusive<StringVal>(end_of_uri - line, line);
+	unescaped_URI = zeek::make_intrusive<StringVal>(
 	    unescape_URI((const u_char*) line, (const u_char*) end_of_uri, this));
 
 	return true;
@@ -1352,21 +1352,21 @@ void HTTP_Analyzer::SetVersion(HTTP_VersionNumber* version, HTTP_VersionNumber n
 
 void HTTP_Analyzer::HTTP_Event(const char* category, const char* detail)
 	{
-	HTTP_Event(category, make_intrusive<StringVal>(detail));
+	HTTP_Event(category, zeek::make_intrusive<StringVal>(detail));
 	}
 
-void HTTP_Analyzer::HTTP_Event(const char* category, IntrusivePtr<StringVal> detail)
+void HTTP_Analyzer::HTTP_Event(const char* category, zeek::IntrusivePtr<StringVal> detail)
 	{
 	if ( http_event )
 		// DEBUG_MSG("%.6f http_event\n", network_time);
 		EnqueueConnEvent(http_event,
 			ConnVal(),
-			make_intrusive<StringVal>(category),
+			zeek::make_intrusive<StringVal>(category),
 			std::move(detail));
 	}
 
-IntrusivePtr<StringVal>
-HTTP_Analyzer::TruncateURI(const IntrusivePtr<StringVal>& uri)
+zeek::IntrusivePtr<StringVal>
+HTTP_Analyzer::TruncateURI(const zeek::IntrusivePtr<StringVal>& uri)
 	{
 	const BroString* str = uri->AsString();
 
@@ -1375,7 +1375,7 @@ HTTP_Analyzer::TruncateURI(const IntrusivePtr<StringVal>& uri)
 		u_char* s = new u_char[truncate_http_URI + 4];
 		memcpy(s, str->Bytes(), truncate_http_URI);
 		memcpy(s + truncate_http_URI, "...", 4);
-		return make_intrusive<StringVal>(new BroString(true, s, truncate_http_URI+3));
+		return zeek::make_intrusive<StringVal>(new BroString(true, s, truncate_http_URI+3));
 		}
 	else
 		return uri;
@@ -1398,7 +1398,7 @@ void HTTP_Analyzer::HTTP_Request()
 			request_method,
 			TruncateURI(request_URI),
 			TruncateURI(unescaped_URI),
-			make_intrusive<StringVal>(fmt("%.1f", request_version.ToDouble()))
+			zeek::make_intrusive<StringVal>(fmt("%.1f", request_version.ToDouble()))
 		);
 	}
 
@@ -1407,11 +1407,11 @@ void HTTP_Analyzer::HTTP_Reply()
 	if ( http_reply )
 		EnqueueConnEvent(http_reply,
 			ConnVal(),
-			make_intrusive<StringVal>(fmt("%.1f", reply_version.ToDouble())),
+			zeek::make_intrusive<StringVal>(fmt("%.1f", reply_version.ToDouble())),
 			val_mgr->Count(reply_code),
 			reply_reason_phrase ?
 				reply_reason_phrase :
-				make_intrusive<StringVal>("<empty>")
+				zeek::make_intrusive<StringVal>("<empty>")
 		);
 	else
 		reply_reason_phrase = nullptr;
@@ -1473,7 +1473,7 @@ void HTTP_Analyzer::ReplyMade(bool interrupted, const char* msg)
 		if ( http_connection_upgrade )
 			EnqueueConnEvent(http_connection_upgrade,
 				ConnVal(),
-				make_intrusive<StringVal>(upgrade_protocol)
+				zeek::make_intrusive<StringVal>(upgrade_protocol)
 			);
 		}
 
@@ -1551,7 +1551,7 @@ int HTTP_Analyzer::HTTP_ReplyLine(const char* line, const char* end_of_line)
 
 	rest = skip_whitespace(rest, end_of_line);
 	reply_reason_phrase =
-	    make_intrusive<StringVal>(end_of_line - rest, (const char *) rest);
+	    zeek::make_intrusive<StringVal>(end_of_line - rest, (const char *) rest);
 
 	return 1;
 	}
@@ -1655,7 +1655,7 @@ void HTTP_Analyzer::HTTP_EntityData(bool is_orig, BroString* entity_data)
 			ConnVal(),
 			val_mgr->Bool(is_orig),
 			val_mgr->Count(entity_data->Len()),
-			make_intrusive<StringVal>(entity_data)
+			zeek::make_intrusive<StringVal>(entity_data)
 		);
 	else
 		delete entity_data;
diff --git a/src/analyzer/protocol/http/HTTP.h b/src/analyzer/protocol/http/HTTP.h
index 63ddfbbb7c..4cc9995222 100644
--- a/src/analyzer/protocol/http/HTTP.h
+++ b/src/analyzer/protocol/http/HTTP.h
@@ -145,7 +145,7 @@ protected:
 
 	HTTP_Entity* current_entity;
 
-	IntrusivePtr<RecordVal> BuildMessageStat(bool interrupted, const char* msg);
+	zeek::IntrusivePtr<RecordVal> BuildMessageStat(bool interrupted, const char* msg);
 };
 
 class HTTP_Analyzer final : public tcp::TCP_ApplicationAnalyzer {
@@ -156,7 +156,7 @@ public:
 	void HTTP_EntityData(bool is_orig, BroString* entity_data);
 	void HTTP_MessageDone(bool is_orig, HTTP_Message* message);
 	void HTTP_Event(const char* category, const char* detail);
-	void HTTP_Event(const char* category, IntrusivePtr<StringVal> detail);
+	void HTTP_Event(const char* category, zeek::IntrusivePtr<StringVal> detail);
 
 	void SkipEntityData(bool is_orig);
 
@@ -237,7 +237,7 @@ protected:
 	int HTTP_ReplyCode(const char* code_str);
 	int ExpectReplyMessageBody();
 
-	IntrusivePtr<StringVal> TruncateURI(const IntrusivePtr<StringVal>& uri);
+	zeek::IntrusivePtr<StringVal> TruncateURI(const zeek::IntrusivePtr<StringVal>& uri);
 
 	int request_state, reply_state;
 	int num_requests, num_replies;
@@ -257,19 +257,19 @@ protected:
 	// in a reply.
 	std::string upgrade_protocol;
 
-	IntrusivePtr<StringVal> request_method;
+	zeek::IntrusivePtr<StringVal> request_method;
 
 	// request_URI is in the original form (may contain '%<hex><hex>'
 	// sequences).
-	IntrusivePtr<StringVal> request_URI;
+	zeek::IntrusivePtr<StringVal> request_URI;
 
 	// unescaped_URI does not contain escaped sequences.
-	IntrusivePtr<StringVal> unescaped_URI;
+	zeek::IntrusivePtr<StringVal> unescaped_URI;
 
-	std::queue<IntrusivePtr<StringVal>> unanswered_requests;
+	std::queue<zeek::IntrusivePtr<StringVal>> unanswered_requests;
 
 	int reply_code;
-	IntrusivePtr<StringVal> reply_reason_phrase;
+	zeek::IntrusivePtr<StringVal> reply_reason_phrase;
 
 	tcp::ContentLine_Analyzer* content_line_orig;
 	tcp::ContentLine_Analyzer* content_line_resp;
diff --git a/src/analyzer/protocol/http/functions.bif b/src/analyzer/protocol/http/functions.bif
index c8c9f2e976..5cba5455a7 100644
--- a/src/analyzer/protocol/http/functions.bif
+++ b/src/analyzer/protocol/http/functions.bif
@@ -52,5 +52,5 @@ function unescape_URI%(URI: string%): string
 	const u_char* line = URI->Bytes();
 	const u_char* const line_end = line + URI->Len();
 
-	return make_intrusive<StringVal>(analyzer::http::unescape_URI(line, line_end, 0));
+	return zeek::make_intrusive<StringVal>(analyzer::http::unescape_URI(line, line_end, 0));
 	%}
diff --git a/src/analyzer/protocol/icmp/ICMP.cc b/src/analyzer/protocol/icmp/ICMP.cc
index c1677c315b..11d057bdae 100644
--- a/src/analyzer/protocol/icmp/ICMP.cc
+++ b/src/analyzer/protocol/icmp/ICMP.cc
@@ -214,22 +214,22 @@ void ICMP_Analyzer::ICMP_Sent(const struct icmp* icmpp, int len, int caplen,
 		EnqueueConnEvent(icmp_sent_payload,
 			ConnVal(),
 			BuildICMPVal(icmpp, len, icmpv6, ip_hdr),
-			make_intrusive<StringVal>(payload)
+			zeek::make_intrusive<StringVal>(payload)
 		);
 		}
 	}
 
-IntrusivePtr<RecordVal>
+zeek::IntrusivePtr<RecordVal>
 ICMP_Analyzer::BuildICMPVal(const struct icmp* icmpp, int len,
                             int icmpv6, const IP_Hdr* ip_hdr)
 	{
 	if ( ! icmp_conn_val )
 		{
 		static auto icmp_conn = zeek::id::find_type<zeek::RecordType>("icmp_conn");
-		icmp_conn_val = make_intrusive<RecordVal>(icmp_conn);
+		icmp_conn_val = zeek::make_intrusive<RecordVal>(icmp_conn);
 
-		icmp_conn_val->Assign(0, make_intrusive<AddrVal>(Conn()->OrigAddr()));
-		icmp_conn_val->Assign(1, make_intrusive<AddrVal>(Conn()->RespAddr()));
+		icmp_conn_val->Assign(0, zeek::make_intrusive<AddrVal>(Conn()->OrigAddr()));
+		icmp_conn_val->Assign(1, zeek::make_intrusive<AddrVal>(Conn()->RespAddr()));
 		icmp_conn_val->Assign(2, val_mgr->Count(icmpp->icmp_type));
 		icmp_conn_val->Assign(3, val_mgr->Count(icmpp->icmp_code));
 		icmp_conn_val->Assign(4, val_mgr->Count(len));
@@ -305,7 +305,7 @@ TransportProto ICMP_Analyzer::GetContextProtocol(const IP_Hdr* ip_hdr, uint32_t*
 	return proto;
 	}
 
-IntrusivePtr<RecordVal> ICMP_Analyzer::ExtractICMP4Context(int len, const u_char*& data)
+zeek::IntrusivePtr<RecordVal> ICMP_Analyzer::ExtractICMP4Context(int len, const u_char*& data)
 	{
 	const IP_Hdr ip_hdr_data((const struct ip*) data, false);
 	const IP_Hdr* ip_hdr = &ip_hdr_data;
@@ -352,12 +352,12 @@ IntrusivePtr<RecordVal> ICMP_Analyzer::ExtractICMP4Context(int len, const u_char
 		}
 
 	static auto icmp_context = zeek::id::find_type<zeek::RecordType>("icmp_context");
-	auto iprec = make_intrusive<RecordVal>(icmp_context);
-	auto id_val = make_intrusive<RecordVal>(zeek::id::conn_id);
+	auto iprec = zeek::make_intrusive<RecordVal>(icmp_context);
+	auto id_val = zeek::make_intrusive<RecordVal>(zeek::id::conn_id);
 
-	id_val->Assign(0, make_intrusive<AddrVal>(src_addr));
+	id_val->Assign(0, zeek::make_intrusive<AddrVal>(src_addr));
 	id_val->Assign(1, val_mgr->Port(src_port, proto));
-	id_val->Assign(2, make_intrusive<AddrVal>(dst_addr));
+	id_val->Assign(2, zeek::make_intrusive<AddrVal>(dst_addr));
 	id_val->Assign(3, val_mgr->Port(dst_port, proto));
 
 	iprec->Assign(0, std::move(id_val));
@@ -372,7 +372,7 @@ IntrusivePtr<RecordVal> ICMP_Analyzer::ExtractICMP4Context(int len, const u_char
 	return iprec;
 	}
 
-IntrusivePtr<RecordVal> ICMP_Analyzer::ExtractICMP6Context(int len, const u_char*& data)
+zeek::IntrusivePtr<RecordVal> ICMP_Analyzer::ExtractICMP6Context(int len, const u_char*& data)
 	{
 	int DF = 0, MF = 0, bad_hdr_len = 0;
 	TransportProto proto = TRANSPORT_UNKNOWN;
@@ -412,12 +412,12 @@ IntrusivePtr<RecordVal> ICMP_Analyzer::ExtractICMP6Context(int len, const u_char
 		}
 
 	static auto icmp_context = zeek::id::find_type<zeek::RecordType>("icmp_context");
-	auto iprec = make_intrusive<RecordVal>(icmp_context);
-	auto id_val = make_intrusive<RecordVal>(zeek::id::conn_id);
+	auto iprec = zeek::make_intrusive<RecordVal>(icmp_context);
+	auto id_val = zeek::make_intrusive<RecordVal>(zeek::id::conn_id);
 
-	id_val->Assign(0, make_intrusive<AddrVal>(src_addr));
+	id_val->Assign(0, zeek::make_intrusive<AddrVal>(src_addr));
 	id_val->Assign(1, val_mgr->Port(src_port, proto));
-	id_val->Assign(2, make_intrusive<AddrVal>(dst_addr));
+	id_val->Assign(2, zeek::make_intrusive<AddrVal>(dst_addr));
 	id_val->Assign(3, val_mgr->Port(dst_port, proto));
 
 	iprec->Assign(0, std::move(id_val));
@@ -469,7 +469,7 @@ void ICMP_Analyzer::UpdateConnVal(RecordVal *conn_val)
 	Analyzer::UpdateConnVal(conn_val);
 	}
 
-void ICMP_Analyzer::UpdateEndpointVal(const IntrusivePtr<Val>& endp_arg, bool is_orig)
+void ICMP_Analyzer::UpdateEndpointVal(const zeek::IntrusivePtr<Val>& endp_arg, bool is_orig)
 	{
 	Conn()->EnableStatusUpdateTimer();
 
@@ -523,7 +523,7 @@ void ICMP_Analyzer::Echo(double t, const struct icmp* icmpp, int len,
 		BuildICMPVal(icmpp, len, ip_hdr->NextProto() != IPPROTO_ICMP, ip_hdr),
 		val_mgr->Count(iid),
 		val_mgr->Count(iseq),
-		make_intrusive<StringVal>(payload)
+		zeek::make_intrusive<StringVal>(payload)
 	);
 	}
 
@@ -556,9 +556,9 @@ void ICMP_Analyzer::RouterAdvert(double t, const struct icmp* icmpp, int len,
 		val_mgr->Count((icmpp->icmp_wpa & 0x18)>>3), // Pref
 		val_mgr->Bool(icmpp->icmp_wpa & 0x04), // Proxy
 		val_mgr->Count(icmpp->icmp_wpa & 0x02), // Reserved
-		make_intrusive<IntervalVal>((double)ntohs(icmpp->icmp_lifetime), Seconds),
-		make_intrusive<IntervalVal>((double)ntohl(reachable), Milliseconds),
-		make_intrusive<IntervalVal>((double)ntohl(retrans), Milliseconds),
+		zeek::make_intrusive<IntervalVal>((double)ntohs(icmpp->icmp_lifetime), Seconds),
+		zeek::make_intrusive<IntervalVal>((double)ntohl(reachable), Milliseconds),
+		zeek::make_intrusive<IntervalVal>((double)ntohl(retrans), Milliseconds),
 		BuildNDOptionsVal(caplen - opt_offset, data + opt_offset)
 	);
 	}
@@ -585,7 +585,7 @@ void ICMP_Analyzer::NeighborAdvert(double t, const struct icmp* icmpp, int len,
 		val_mgr->Bool(icmpp->icmp_num_addrs & 0x80), // Router
 		val_mgr->Bool(icmpp->icmp_num_addrs & 0x40), // Solicited
 		val_mgr->Bool(icmpp->icmp_num_addrs & 0x20), // Override
-		make_intrusive<AddrVal>(tgtaddr),
+		zeek::make_intrusive<AddrVal>(tgtaddr),
 		BuildNDOptionsVal(caplen - opt_offset, data + opt_offset)
 	);
 	}
@@ -609,7 +609,7 @@ void ICMP_Analyzer::NeighborSolicit(double t, const struct icmp* icmpp, int len,
 	EnqueueConnEvent(f,
 		ConnVal(),
 		BuildICMPVal(icmpp, len, 1, ip_hdr),
-		make_intrusive<AddrVal>(tgtaddr),
+		zeek::make_intrusive<AddrVal>(tgtaddr),
 		BuildNDOptionsVal(caplen - opt_offset, data + opt_offset)
 	);
 	}
@@ -636,8 +636,8 @@ void ICMP_Analyzer::Redirect(double t, const struct icmp* icmpp, int len,
 	EnqueueConnEvent(f,
 		ConnVal(),
 		BuildICMPVal(icmpp, len, 1, ip_hdr),
-		make_intrusive<AddrVal>(tgtaddr),
-		make_intrusive<AddrVal>(dstaddr),
+		zeek::make_intrusive<AddrVal>(tgtaddr),
+		zeek::make_intrusive<AddrVal>(dstaddr),
 		BuildNDOptionsVal(caplen - opt_offset, data + opt_offset)
 	);
 	}
@@ -722,12 +722,12 @@ void ICMP_Analyzer::Context6(double t, const struct icmp* icmpp,
 		);
 	}
 
-IntrusivePtr<VectorVal> ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data)
+zeek::IntrusivePtr<VectorVal> ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data)
 	{
 	static auto icmp6_nd_option_type = zeek::id::find_type<zeek::RecordType>("icmp6_nd_option");
 	static auto icmp6_nd_prefix_info_type = zeek::id::find_type<zeek::RecordType>("icmp6_nd_prefix_info");
 
-	auto vv = make_intrusive<VectorVal>(
+	auto vv = zeek::make_intrusive<VectorVal>(
 		zeek::id::find_type<zeek::VectorType>("icmp6_nd_options"));
 
 	while ( caplen > 0 )
@@ -748,7 +748,7 @@ IntrusivePtr<VectorVal> ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_cha
 			break;
 			}
 
-		auto rv = make_intrusive<RecordVal>(icmp6_nd_option_type);
+		auto rv = zeek::make_intrusive<RecordVal>(icmp6_nd_option_type);
 		rv->Assign(0, val_mgr->Count(type));
 		rv->Assign(1, val_mgr->Count(length));
 
@@ -769,7 +769,7 @@ IntrusivePtr<VectorVal> ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_cha
 			if ( caplen >= length )
 				{
 				BroString* link_addr = new BroString(data, length, false);
-				rv->Assign(2, make_intrusive<StringVal>(link_addr));
+				rv->Assign(2, zeek::make_intrusive<StringVal>(link_addr));
 				}
 			else
 				set_payload_field = true;
@@ -782,7 +782,7 @@ IntrusivePtr<VectorVal> ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_cha
 			{
 			if ( caplen >= 30 )
 				{
-				auto info = make_intrusive<RecordVal>(icmp6_nd_prefix_info_type);
+				auto info = zeek::make_intrusive<RecordVal>(icmp6_nd_prefix_info_type);
 				uint8_t prefix_len = *((const uint8_t*)(data));
 				bool L_flag = (*((const uint8_t*)(data + 1)) & 0x80) != 0;
 				bool A_flag = (*((const uint8_t*)(data + 1)) & 0x40) != 0;
@@ -792,9 +792,9 @@ IntrusivePtr<VectorVal> ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_cha
 				info->Assign(0, val_mgr->Count(prefix_len));
 				info->Assign(1, val_mgr->Bool(L_flag));
 				info->Assign(2, val_mgr->Bool(A_flag));
-				info->Assign(3, make_intrusive<IntervalVal>((double)ntohl(valid_life), Seconds));
-				info->Assign(4, make_intrusive<IntervalVal>((double)ntohl(prefer_life), Seconds));
-				info->Assign(5, make_intrusive<AddrVal>(IPAddr(prefix)));
+				info->Assign(3, zeek::make_intrusive<IntervalVal>((double)ntohl(valid_life), Seconds));
+				info->Assign(4, zeek::make_intrusive<IntervalVal>((double)ntohl(prefer_life), Seconds));
+				info->Assign(5, zeek::make_intrusive<AddrVal>(IPAddr(prefix)));
 				rv->Assign(3, std::move(info));
 				}
 
@@ -839,7 +839,7 @@ IntrusivePtr<VectorVal> ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_cha
 		if ( set_payload_field )
 			{
 			BroString* payload = new BroString(data, std::min((int)length, caplen), false);
-			rv->Assign(6, make_intrusive<StringVal>(payload));
+			rv->Assign(6, zeek::make_intrusive<StringVal>(payload));
 			}
 
 		data += length;
diff --git a/src/analyzer/protocol/icmp/ICMP.h b/src/analyzer/protocol/icmp/ICMP.h
index 74ecb3a322..502f094a03 100644
--- a/src/analyzer/protocol/icmp/ICMP.h
+++ b/src/analyzer/protocol/icmp/ICMP.h
@@ -51,13 +51,13 @@ protected:
 
 	void Describe(ODesc* d) const;
 
-	IntrusivePtr<RecordVal> BuildICMPVal(const struct icmp* icmpp, int len,
+	zeek::IntrusivePtr<RecordVal> BuildICMPVal(const struct icmp* icmpp, int len,
 	                                     int icmpv6, const IP_Hdr* ip_hdr);
 
 	void NextICMP4(double t, const struct icmp* icmpp, int len, int caplen,
 			const u_char*& data, const IP_Hdr* ip_hdr );
 
-	IntrusivePtr<RecordVal> ExtractICMP4Context(int len, const u_char*& data);
+	zeek::IntrusivePtr<RecordVal> ExtractICMP4Context(int len, const u_char*& data);
 
 	void Context4(double t, const struct icmp* icmpp, int len, int caplen,
 			const u_char*& data, const IP_Hdr* ip_hdr);
@@ -68,15 +68,15 @@ protected:
 	void NextICMP6(double t, const struct icmp* icmpp, int len, int caplen,
 			const u_char*& data, const IP_Hdr* ip_hdr );
 
-	IntrusivePtr<RecordVal> ExtractICMP6Context(int len, const u_char*& data);
+	zeek::IntrusivePtr<RecordVal> ExtractICMP6Context(int len, const u_char*& data);
 
 	void Context6(double t, const struct icmp* icmpp, int len, int caplen,
 			const u_char*& data, const IP_Hdr* ip_hdr);
 
 	// RFC 4861 Neighbor Discover message options
-	IntrusivePtr<VectorVal> BuildNDOptionsVal(int caplen, const u_char* data);
+	zeek::IntrusivePtr<VectorVal> BuildNDOptionsVal(int caplen, const u_char* data);
 
-	IntrusivePtr<RecordVal> icmp_conn_val;
+	zeek::IntrusivePtr<RecordVal> icmp_conn_val;
 	int type;
 	int code;
 	int request_len, reply_len;
@@ -84,7 +84,7 @@ protected:
 	RuleMatcherState matcher_state;
 
 private:
-	void UpdateEndpointVal(const IntrusivePtr<Val>& endp, bool is_orig);
+	void UpdateEndpointVal(const zeek::IntrusivePtr<Val>& endp, bool is_orig);
 };
 
 // Returns the counterpart type to the given type (e.g., the counterpart
diff --git a/src/analyzer/protocol/ident/Ident.cc b/src/analyzer/protocol/ident/Ident.cc
index 8db6e4185f..5e78a88035 100644
--- a/src/analyzer/protocol/ident/Ident.cc
+++ b/src/analyzer/protocol/ident/Ident.cc
@@ -149,7 +149,7 @@ void Ident_Analyzer::DeliverStream(int length, const u_char* data, bool is_orig)
 					ConnVal(),
 					val_mgr->Port(local_port, TRANSPORT_TCP),
 					val_mgr->Port(remote_port, TRANSPORT_TCP),
-					make_intrusive<StringVal>(end_of_line - line, line)
+					zeek::make_intrusive<StringVal>(end_of_line - line, line)
 				);
 			}
 
@@ -182,8 +182,8 @@ void Ident_Analyzer::DeliverStream(int length, const u_char* data, bool is_orig)
 				ConnVal(),
 				val_mgr->Port(local_port, TRANSPORT_TCP),
 				val_mgr->Port(remote_port, TRANSPORT_TCP),
-				make_intrusive<StringVal>(end_of_line - line, line),
-				make_intrusive<StringVal>(sys_type_s)
+				zeek::make_intrusive<StringVal>(end_of_line - line, line),
+				zeek::make_intrusive<StringVal>(sys_type_s)
 			);
 			}
 		}
diff --git a/src/analyzer/protocol/imap/imap-analyzer.pac b/src/analyzer/protocol/imap/imap-analyzer.pac
index 677e3789ec..e127374fad 100644
--- a/src/analyzer/protocol/imap/imap-analyzer.pac
+++ b/src/analyzer/protocol/imap/imap-analyzer.pac
@@ -59,12 +59,12 @@ refine connection IMAP_Conn += {
 		if ( ! imap_capabilities )
 			return true;
 
-		auto capv = make_intrusive<VectorVal>(zeek::id::string_vec);
+		auto capv = zeek::make_intrusive<VectorVal>(zeek::id::string_vec);
 
 		for ( unsigned int i = 0; i< capabilities->size(); i++ )
 			{
 			const bytestring& capability = (*capabilities)[i]->cap();
-			capv->Assign(i, make_intrusive<StringVal>(capability.length(), (const char*)capability.data()));
+			capv->Assign(i, zeek::make_intrusive<StringVal>(capability.length(), (const char*)capability.data()));
 			}
 
 		zeek::BifEvent::enqueue_imap_capabilities(bro_analyzer(), bro_analyzer()->Conn(), std::move(capv));
diff --git a/src/analyzer/protocol/irc/IRC.cc b/src/analyzer/protocol/irc/IRC.cc
index 4c1e817a99..7f197a2d04 100644
--- a/src/analyzer/protocol/irc/IRC.cc
+++ b/src/analyzer/protocol/irc/IRC.cc
@@ -273,21 +273,21 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 			if ( parts.size() > 0 && parts[0][0] == ':' )
 				parts[0] = parts[0].substr(1);
 
-			auto set = make_intrusive<TableVal>(zeek::id::string_set);
+			auto set = zeek::make_intrusive<TableVal>(zeek::id::string_set);
 
 			for ( unsigned int i = 0; i < parts.size(); ++i )
 				{
 				if ( parts[i][0] == '@' )
 					parts[i] = parts[i].substr(1);
-				auto idx = make_intrusive<StringVal>(parts[i].c_str());
+				auto idx = zeek::make_intrusive<StringVal>(parts[i].c_str());
 				set->Assign(std::move(idx), nullptr);
 				}
 
 			EnqueueConnEvent(irc_names_info,
 				ConnVal(),
 				val_mgr->Bool(orig),
-				make_intrusive<StringVal>(type.c_str()),
-				make_intrusive<StringVal>(channel.c_str()),
+				zeek::make_intrusive<StringVal>(type.c_str()),
+				zeek::make_intrusive<StringVal>(channel.c_str()),
 				std::move(set)
 			);
 			}
@@ -374,8 +374,8 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 			EnqueueConnEvent(irc_global_users,
 				ConnVal(),
 				val_mgr->Bool(orig),
-				make_intrusive<StringVal>(eop - prefix, prefix),
-				make_intrusive<StringVal>(++msg)
+				zeek::make_intrusive<StringVal>(eop - prefix, prefix),
+				zeek::make_intrusive<StringVal>(++msg)
 			);
 			break;
 			}
@@ -400,9 +400,9 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 			vl.reserve(6);
 			vl.emplace_back(ConnVal());
 			vl.emplace_back(val_mgr->Bool(orig));
-			vl.emplace_back(make_intrusive<StringVal>(parts[0].c_str()));
-			vl.emplace_back(make_intrusive<StringVal>(parts[1].c_str()));
-			vl.emplace_back(make_intrusive<StringVal>(parts[2].c_str()));
+			vl.emplace_back(zeek::make_intrusive<StringVal>(parts[0].c_str()));
+			vl.emplace_back(zeek::make_intrusive<StringVal>(parts[1].c_str()));
+			vl.emplace_back(zeek::make_intrusive<StringVal>(parts[2].c_str()));
 
 			parts.erase(parts.begin(), parts.begin() + 4);
 
@@ -413,7 +413,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 			if ( real_name[0] == ':' )
 				real_name = real_name.substr(1);
 
-			vl.emplace_back(make_intrusive<StringVal>(real_name.c_str()));
+			vl.emplace_back(zeek::make_intrusive<StringVal>(real_name.c_str()));
 
 			EnqueueConnEvent(irc_whois_user_line, std::move(vl));
 			}
@@ -439,7 +439,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 			EnqueueConnEvent(irc_whois_operator_line,
 				ConnVal(),
 				val_mgr->Bool(orig),
-				make_intrusive<StringVal>(parts[0].c_str())
+				zeek::make_intrusive<StringVal>(parts[0].c_str())
 			);
 			}
 			break;
@@ -466,18 +466,18 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 			if ( parts.size() > 0 && parts[0][0] == ':' )
 				parts[0] = parts[0].substr(1);
 
-			auto set = make_intrusive<TableVal>(zeek::id::string_set);
+			auto set = zeek::make_intrusive<TableVal>(zeek::id::string_set);
 
 			for ( unsigned int i = 0; i < parts.size(); ++i )
 				{
-				auto idx = make_intrusive<StringVal>(parts[i].c_str());
+				auto idx = zeek::make_intrusive<StringVal>(parts[i].c_str());
 				set->Assign(std::move(idx), nullptr);
 				}
 
 			EnqueueConnEvent(irc_whois_channel_line,
 				ConnVal(),
 				val_mgr->Bool(orig),
-				make_intrusive<StringVal>(nick.c_str()),
+				zeek::make_intrusive<StringVal>(nick.c_str()),
 				std::move(set)
 			);
 			}
@@ -508,8 +508,8 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 				EnqueueConnEvent(irc_channel_topic,
 					ConnVal(),
 					val_mgr->Bool(orig),
-					make_intrusive<StringVal>(parts[1].c_str()),
-					make_intrusive<StringVal>(t)
+					zeek::make_intrusive<StringVal>(parts[1].c_str()),
+					zeek::make_intrusive<StringVal>(t)
 				);
 				}
 			else
@@ -542,15 +542,15 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 			EnqueueConnEvent(irc_who_line,
 				ConnVal(),
 				val_mgr->Bool(orig),
-				make_intrusive<StringVal>(parts[0].c_str()),
-				make_intrusive<StringVal>(parts[1].c_str()),
-				make_intrusive<StringVal>(parts[2].c_str()),
-				make_intrusive<StringVal>(parts[3].c_str()),
-				make_intrusive<StringVal>(parts[4].c_str()),
-				make_intrusive<StringVal>(parts[5].c_str()),
-				make_intrusive<StringVal>(parts[6].c_str()),
+				zeek::make_intrusive<StringVal>(parts[0].c_str()),
+				zeek::make_intrusive<StringVal>(parts[1].c_str()),
+				zeek::make_intrusive<StringVal>(parts[2].c_str()),
+				zeek::make_intrusive<StringVal>(parts[3].c_str()),
+				zeek::make_intrusive<StringVal>(parts[4].c_str()),
+				zeek::make_intrusive<StringVal>(parts[5].c_str()),
+				zeek::make_intrusive<StringVal>(parts[6].c_str()),
 				val_mgr->Int(atoi(parts[7].c_str())),
-				make_intrusive<StringVal>(parts[8].c_str())
+				zeek::make_intrusive<StringVal>(parts[8].c_str())
 			);
 			}
 			break;
@@ -589,9 +589,9 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 				EnqueueConnEvent(irc_reply,
 					ConnVal(),
 					val_mgr->Bool(orig),
-					make_intrusive<StringVal>(prefix.c_str()),
+					zeek::make_intrusive<StringVal>(prefix.c_str()),
 					val_mgr->Count(code),
-					make_intrusive<StringVal>(params.c_str())
+					zeek::make_intrusive<StringVal>(params.c_str())
 				);
 			break;
 		}
@@ -660,11 +660,11 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 				EnqueueConnEvent(irc_dcc_message,
 					ConnVal(),
 					val_mgr->Bool(orig),
-					make_intrusive<StringVal>(prefix.c_str()),
-					make_intrusive<StringVal>(target.c_str()),
-					make_intrusive<StringVal>(parts[1].c_str()),
-					make_intrusive<StringVal>(parts[2].c_str()),
-					make_intrusive<AddrVal>(htonl(raw_ip)),
+					zeek::make_intrusive<StringVal>(prefix.c_str()),
+					zeek::make_intrusive<StringVal>(target.c_str()),
+					zeek::make_intrusive<StringVal>(parts[1].c_str()),
+					zeek::make_intrusive<StringVal>(parts[2].c_str()),
+					zeek::make_intrusive<AddrVal>(htonl(raw_ip)),
 					val_mgr->Count(atoi(parts[4].c_str())),
 					parts.size() >= 6 ? val_mgr->Count(atoi(parts[5].c_str())) : val_mgr->Count(0)
 				);
@@ -676,9 +676,9 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 				EnqueueConnEvent(irc_privmsg_message,
 					ConnVal(),
 					val_mgr->Bool(orig),
-					make_intrusive<StringVal>(prefix.c_str()),
-					make_intrusive<StringVal>(target.c_str()),
-					make_intrusive<StringVal>(message.c_str())
+					zeek::make_intrusive<StringVal>(prefix.c_str()),
+					zeek::make_intrusive<StringVal>(target.c_str()),
+					zeek::make_intrusive<StringVal>(message.c_str())
 				);
 			}
 		}
@@ -701,9 +701,9 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 		EnqueueConnEvent(irc_notice_message,
 			ConnVal(),
 			val_mgr->Bool(orig),
-			make_intrusive<StringVal>(prefix.c_str()),
-			make_intrusive<StringVal>(target.c_str()),
-			make_intrusive<StringVal>(message.c_str())
+			zeek::make_intrusive<StringVal>(prefix.c_str()),
+			zeek::make_intrusive<StringVal>(target.c_str()),
+			zeek::make_intrusive<StringVal>(message.c_str())
 		);
 		}
 
@@ -725,9 +725,9 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 		EnqueueConnEvent(irc_squery_message,
 			ConnVal(),
 			val_mgr->Bool(orig),
-			make_intrusive<StringVal>(prefix.c_str()),
-			make_intrusive<StringVal>(target.c_str()),
-			make_intrusive<StringVal>(message.c_str())
+			zeek::make_intrusive<StringVal>(prefix.c_str()),
+			zeek::make_intrusive<StringVal>(target.c_str()),
+			zeek::make_intrusive<StringVal>(message.c_str())
 		);
 		}
 
@@ -741,15 +741,15 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 		vl.emplace_back(val_mgr->Bool(orig));
 
 		if ( parts.size() > 0 )
-			vl.emplace_back(make_intrusive<StringVal>(parts[0].c_str()));
+			vl.emplace_back(zeek::make_intrusive<StringVal>(parts[0].c_str()));
 		else vl.emplace_back(val_mgr->EmptyString());
 
 		if ( parts.size() > 1 )
-			vl.emplace_back(make_intrusive<StringVal>(parts[1].c_str()));
+			vl.emplace_back(zeek::make_intrusive<StringVal>(parts[1].c_str()));
 		else vl.emplace_back(val_mgr->EmptyString());
 
 		if ( parts.size() > 2 )
-			vl.emplace_back(make_intrusive<StringVal>(parts[2].c_str()));
+			vl.emplace_back(zeek::make_intrusive<StringVal>(parts[2].c_str()));
 		else vl.emplace_back(val_mgr->EmptyString());
 
 		string realname;
@@ -761,7 +761,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 			}
 
 		const char* name = realname.c_str();
-		vl.emplace_back(make_intrusive<StringVal>(*name == ':' ? name + 1 : name));
+		vl.emplace_back(zeek::make_intrusive<StringVal>(*name == ':' ? name + 1 : name));
 
 		EnqueueConnEvent(irc_user_message, std::move(vl));
 		}
@@ -774,8 +774,8 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 			EnqueueConnEvent(irc_oper_message,
 				ConnVal(),
 				val_mgr->Bool(orig),
-				make_intrusive<StringVal>(parts[0].c_str()),
-				make_intrusive<StringVal>(parts[1].c_str())
+				zeek::make_intrusive<StringVal>(parts[0].c_str()),
+				zeek::make_intrusive<StringVal>(parts[1].c_str())
 			);
 
 		else
@@ -796,9 +796,9 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 		vl.reserve(6);
 		vl.emplace_back(ConnVal());
 		vl.emplace_back(val_mgr->Bool(orig));
-		vl.emplace_back(make_intrusive<StringVal>(prefix.c_str()));
-		vl.emplace_back(make_intrusive<StringVal>(parts[0].c_str()));
-		vl.emplace_back(make_intrusive<StringVal>(parts[1].c_str()));
+		vl.emplace_back(zeek::make_intrusive<StringVal>(prefix.c_str()));
+		vl.emplace_back(zeek::make_intrusive<StringVal>(parts[0].c_str()));
+		vl.emplace_back(zeek::make_intrusive<StringVal>(parts[1].c_str()));
 
 		if ( parts.size() > 2 )
 			{
@@ -809,7 +809,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 			if ( comment[0] == ':' )
 				comment = comment.substr(1);
 
-			vl.emplace_back(make_intrusive<StringVal>(comment.c_str()));
+			vl.emplace_back(zeek::make_intrusive<StringVal>(comment.c_str()));
 			}
 		else
 			vl.emplace_back(val_mgr->EmptyString());
@@ -838,7 +838,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 				nickname = prefix.substr(0, pos);
 			}
 
-		auto list = make_intrusive<TableVal>(irc_join_list);
+		auto list = zeek::make_intrusive<TableVal>(irc_join_list);
 
 		vector<string> channels = SplitWords(parts[0], ',');
 		vector<string> passwords;
@@ -849,15 +849,15 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 		string empty_string = "";
 		for ( unsigned int i = 0; i < channels.size(); ++i )
 			{
-			auto info = make_intrusive<RecordVal>(irc_join_info);
-			info->Assign(0, make_intrusive<StringVal>(nickname.c_str()));
-			info->Assign(1, make_intrusive<StringVal>(channels[i].c_str()));
+			auto info = zeek::make_intrusive<RecordVal>(irc_join_info);
+			info->Assign(0, zeek::make_intrusive<StringVal>(nickname.c_str()));
+			info->Assign(1, zeek::make_intrusive<StringVal>(channels[i].c_str()));
 			if ( i < passwords.size() )
-				info->Assign(2, make_intrusive<StringVal>(passwords[i].c_str()));
+				info->Assign(2, zeek::make_intrusive<StringVal>(passwords[i].c_str()));
 			else
-				info->Assign(2, make_intrusive<StringVal>(empty_string.c_str()));
+				info->Assign(2, zeek::make_intrusive<StringVal>(empty_string.c_str()));
 			// User mode.
-			info->Assign(3, make_intrusive<StringVal>(empty_string.c_str()));
+			info->Assign(3, zeek::make_intrusive<StringVal>(empty_string.c_str()));
 			list->Assign(std::move(info), nullptr);
 			}
 
@@ -882,13 +882,13 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 			parts[1] = parts[1].substr(1);
 
 		vector<string> users = SplitWords(parts[1], ',');
-		auto list = make_intrusive<TableVal>(irc_join_list);
+		auto list = zeek::make_intrusive<TableVal>(irc_join_list);
 
 		string empty_string = "";
 
 		for ( unsigned int i = 0; i < users.size(); ++i )
 			{
-			auto info = make_intrusive<RecordVal>(irc_join_info);
+			auto info = zeek::make_intrusive<RecordVal>(irc_join_info);
 			string nick = users[i];
 			string mode = "none";
 
@@ -912,12 +912,12 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 				mode = "voice";
 				}
 
-			info->Assign(0, make_intrusive<StringVal>(nick.c_str()));
-			info->Assign(1, make_intrusive<StringVal>(channel.c_str()));
+			info->Assign(0, zeek::make_intrusive<StringVal>(nick.c_str()));
+			info->Assign(1, zeek::make_intrusive<StringVal>(channel.c_str()));
 			// Password:
-			info->Assign(2, make_intrusive<StringVal>(empty_string.c_str()));
+			info->Assign(2, zeek::make_intrusive<StringVal>(empty_string.c_str()));
 			// User mode:
-			info->Assign(3, make_intrusive<StringVal>(mode.c_str()));
+			info->Assign(3, zeek::make_intrusive<StringVal>(mode.c_str()));
 			list->Assign(std::move(info), nullptr);
 			}
 
@@ -952,20 +952,20 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 			nick = nick.substr(0, pos);
 
 		vector<string> channelList = SplitWords(channels, ',');
-		auto set = make_intrusive<TableVal>(zeek::id::string_set);
+		auto set = zeek::make_intrusive<TableVal>(zeek::id::string_set);
 
 		for ( unsigned int i = 0; i < channelList.size(); ++i )
 			{
-			auto idx = make_intrusive<StringVal>(channelList[i].c_str());
+			auto idx = zeek::make_intrusive<StringVal>(channelList[i].c_str());
 			set->Assign(std::move(idx), nullptr);
 			}
 
 		EnqueueConnEvent(irc_part_message,
 			ConnVal(),
 			val_mgr->Bool(orig),
-			make_intrusive<StringVal>(nick.c_str()),
+			zeek::make_intrusive<StringVal>(nick.c_str()),
 			std::move(set),
-			make_intrusive<StringVal>(message.c_str())
+			zeek::make_intrusive<StringVal>(message.c_str())
 		);
 		}
 
@@ -986,8 +986,8 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 		EnqueueConnEvent(irc_quit_message,
 			ConnVal(),
 			val_mgr->Bool(orig),
-			make_intrusive<StringVal>(nickname.c_str()),
-			make_intrusive<StringVal>(message.c_str())
+			zeek::make_intrusive<StringVal>(nickname.c_str()),
+			zeek::make_intrusive<StringVal>(message.c_str())
 		);
 		}
 
@@ -1000,8 +1000,8 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 		EnqueueConnEvent(irc_nick_message,
 			ConnVal(),
 			val_mgr->Bool(orig),
-			make_intrusive<StringVal>(prefix.c_str()),
-			make_intrusive<StringVal>(nick.c_str())
+			zeek::make_intrusive<StringVal>(prefix.c_str()),
+			zeek::make_intrusive<StringVal>(nick.c_str())
 		);
 		}
 
@@ -1026,7 +1026,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 			ConnVal(),
 			val_mgr->Bool(orig),
 			parts.size() > 0 ?
-				make_intrusive<StringVal>(parts[0].c_str()) :
+				zeek::make_intrusive<StringVal>(parts[0].c_str()) :
 				val_mgr->EmptyString(),
 			val_mgr->Bool(oper)
 		);
@@ -1055,8 +1055,8 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 		EnqueueConnEvent(irc_whois_message,
 			ConnVal(),
 			val_mgr->Bool(orig),
-			make_intrusive<StringVal>(server.c_str()),
-			make_intrusive<StringVal>(users.c_str())
+			zeek::make_intrusive<StringVal>(server.c_str()),
+			zeek::make_intrusive<StringVal>(users.c_str())
 		);
 		}
 
@@ -1068,8 +1068,8 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 		EnqueueConnEvent(irc_error_message,
 			ConnVal(),
 			val_mgr->Bool(orig),
-			make_intrusive<StringVal>(prefix.c_str()),
-			make_intrusive<StringVal>(params.c_str())
+			zeek::make_intrusive<StringVal>(prefix.c_str()),
+			zeek::make_intrusive<StringVal>(params.c_str())
 		);
 		}
 
@@ -1084,9 +1084,9 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 			EnqueueConnEvent(irc_invite_message,
 				ConnVal(),
 				val_mgr->Bool(orig),
-				make_intrusive<StringVal>(prefix.c_str()),
-				make_intrusive<StringVal>(parts[0].c_str()),
-				make_intrusive<StringVal>(parts[1].c_str())
+				zeek::make_intrusive<StringVal>(prefix.c_str()),
+				zeek::make_intrusive<StringVal>(parts[0].c_str()),
+				zeek::make_intrusive<StringVal>(parts[1].c_str())
 			);
 			}
 		else
@@ -1099,8 +1099,8 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 			EnqueueConnEvent(irc_mode_message,
 				ConnVal(),
 				val_mgr->Bool(orig),
-				make_intrusive<StringVal>(prefix.c_str()),
-				make_intrusive<StringVal>(params.c_str())
+				zeek::make_intrusive<StringVal>(prefix.c_str()),
+				zeek::make_intrusive<StringVal>(params.c_str())
 			);
 
 		else
@@ -1112,7 +1112,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 		EnqueueConnEvent(irc_password_message,
 			ConnVal(),
 			val_mgr->Bool(orig),
-			make_intrusive<StringVal>(params.c_str())
+			zeek::make_intrusive<StringVal>(params.c_str())
 		);
 		}
 
@@ -1134,9 +1134,9 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 		EnqueueConnEvent(irc_squit_message,
 			ConnVal(),
 			val_mgr->Bool(orig),
-			make_intrusive<StringVal>(prefix.c_str()),
-			make_intrusive<StringVal>(server.c_str()),
-			make_intrusive<StringVal>(message.c_str())
+			zeek::make_intrusive<StringVal>(prefix.c_str()),
+			zeek::make_intrusive<StringVal>(server.c_str()),
+			zeek::make_intrusive<StringVal>(message.c_str())
 		);
 		}
 
@@ -1148,9 +1148,9 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 			EnqueueConnEvent(irc_request,
 				ConnVal(),
 				val_mgr->Bool(orig),
-				make_intrusive<StringVal>(prefix.c_str()),
-				make_intrusive<StringVal>(command.c_str()),
-				make_intrusive<StringVal>(params.c_str())
+				zeek::make_intrusive<StringVal>(prefix.c_str()),
+				zeek::make_intrusive<StringVal>(command.c_str()),
+				zeek::make_intrusive<StringVal>(params.c_str())
 			);
 			}
 		}
@@ -1162,9 +1162,9 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 			EnqueueConnEvent(irc_message,
 				ConnVal(),
 				val_mgr->Bool(orig),
-				make_intrusive<StringVal>(prefix.c_str()),
-				make_intrusive<StringVal>(command.c_str()),
-				make_intrusive<StringVal>(params.c_str())
+				zeek::make_intrusive<StringVal>(prefix.c_str()),
+				zeek::make_intrusive<StringVal>(command.c_str()),
+				zeek::make_intrusive<StringVal>(params.c_str())
 			);
 			}
 		}
diff --git a/src/analyzer/protocol/krb/KRB.cc b/src/analyzer/protocol/krb/KRB.cc
index 5d66d7942a..498911c1bf 100644
--- a/src/analyzer/protocol/krb/KRB.cc
+++ b/src/analyzer/protocol/krb/KRB.cc
@@ -87,9 +87,9 @@ void KRB_Analyzer::DeliverPacket(int len, const u_char* data, bool orig,
 		}
 	}
 
-IntrusivePtr<StringVal> KRB_Analyzer::GetAuthenticationInfo(const BroString* principal,
-                                                            const BroString* ciphertext,
-                                                            const bro_uint_t enctype)
+zeek::IntrusivePtr<StringVal> KRB_Analyzer::GetAuthenticationInfo(const BroString* principal,
+                                                                  const BroString* ciphertext,
+                                                                  const bro_uint_t enctype)
 	{
 #ifdef USE_KRB5
 	if ( !krb_available )
@@ -147,7 +147,7 @@ IntrusivePtr<StringVal> KRB_Analyzer::GetAuthenticationInfo(const BroString* pri
 		return nullptr;
 		}
 
-	auto ret = make_intrusive<StringVal>(cp);
+	auto ret = zeek::make_intrusive<StringVal>(cp);
 
 	krb5_free_unparsed_name(krb_context, cp);
 	krb5_free_ticket(krb_context, tkt);
diff --git a/src/analyzer/protocol/krb/KRB.h b/src/analyzer/protocol/krb/KRB.h
index a34ccbe4b4..dde2110d5d 100644
--- a/src/analyzer/protocol/krb/KRB.h
+++ b/src/analyzer/protocol/krb/KRB.h
@@ -25,9 +25,9 @@ public:
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{ return new KRB_Analyzer(conn); }
 
-	IntrusivePtr<StringVal> GetAuthenticationInfo(const BroString* principal,
-	                                              const BroString* ciphertext,
-	                                              const bro_uint_t enctype);
+	zeek::IntrusivePtr<StringVal> GetAuthenticationInfo(const BroString* principal,
+	                                                    const BroString* ciphertext,
+	                                                    const bro_uint_t enctype);
 
 protected:
 
diff --git a/src/analyzer/protocol/krb/KRB_TCP.h b/src/analyzer/protocol/krb/KRB_TCP.h
index 7cc1a83a5d..5f6718d854 100644
--- a/src/analyzer/protocol/krb/KRB_TCP.h
+++ b/src/analyzer/protocol/krb/KRB_TCP.h
@@ -21,9 +21,9 @@ public:
 	// Overriden from tcp::TCP_ApplicationAnalyzer.
 	void EndpointEOF(bool is_orig) override;
 
-	IntrusivePtr<StringVal> GetAuthenticationInfo(const BroString* principal,
-	                                              const BroString* ciphertext,
-	                                              const bro_uint_t enctype)
+	zeek::IntrusivePtr<StringVal> GetAuthenticationInfo(const BroString* principal,
+	                                                    const BroString* ciphertext,
+	                                                    const bro_uint_t enctype)
 		{ return val_mgr->EmptyString(); }
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
diff --git a/src/analyzer/protocol/krb/krb-analyzer.pac b/src/analyzer/protocol/krb/krb-analyzer.pac
index 3d19ef2777..aa26e2d748 100644
--- a/src/analyzer/protocol/krb/krb-analyzer.pac
+++ b/src/analyzer/protocol/krb/krb-analyzer.pac
@@ -1,14 +1,14 @@
 %header{
-IntrusivePtr<RecordVal> proc_krb_kdc_options(const KRB_KDC_Options* opts);
-IntrusivePtr<RecordVal> proc_krb_kdc_req_arguments(KRB_KDC_REQ* msg, const BroAnalyzer bro_analyzer);
+zeek::IntrusivePtr<RecordVal> proc_krb_kdc_options(const KRB_KDC_Options* opts);
+zeek::IntrusivePtr<RecordVal> proc_krb_kdc_req_arguments(KRB_KDC_REQ* msg, const BroAnalyzer bro_analyzer);
 
 bool proc_error_arguments(RecordVal* rv, const std::vector<KRB_ERROR_Arg*>* args, int64 error_code);
 %}
 
 %code{
-IntrusivePtr<RecordVal> proc_krb_kdc_options(const KRB_KDC_Options* opts)
+zeek::IntrusivePtr<RecordVal> proc_krb_kdc_options(const KRB_KDC_Options* opts)
 {
-	auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::KDC_Options);
+	auto rv = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::KRB::KDC_Options);
 
 	rv->Assign(0, val_mgr->Bool(opts->forwardable()));
 	rv->Assign(1, val_mgr->Bool(opts->forwarded()));
@@ -27,9 +27,9 @@ IntrusivePtr<RecordVal> proc_krb_kdc_options(const KRB_KDC_Options* opts)
 	return rv;
 }
 
-IntrusivePtr<RecordVal> proc_krb_kdc_req_arguments(KRB_KDC_REQ* msg, const BroAnalyzer bro_analyzer)
+zeek::IntrusivePtr<RecordVal> proc_krb_kdc_req_arguments(KRB_KDC_REQ* msg, const BroAnalyzer bro_analyzer)
 {
-	auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::KDC_Request);
+	auto rv = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::KRB::KDC_Request);
 
 	rv->Assign(0, asn1_integer_to_val(msg->pvno()->data(), zeek::TYPE_COUNT));
 	rv->Assign(1, asn1_integer_to_val(msg->msg_type()->data(), zeek::TYPE_COUNT));
@@ -201,9 +201,9 @@ refine connection KRB_Conn += {
 		%{
 		bro_analyzer()->ProtocolConfirmation();
 		auto msg_type = binary_to_int64(${msg.msg_type.data.content});
-		auto make_arg = [this, msg]() -> IntrusivePtr<RecordVal>
+		auto make_arg = [this, msg]() -> zeek::IntrusivePtr<RecordVal>
 			{
-			auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::KDC_Response);
+			auto rv = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::KRB::KDC_Response);
 
 			rv->Assign(0, asn1_integer_to_val(${msg.pvno.data}, zeek::TYPE_COUNT));
 			rv->Assign(1, asn1_integer_to_val(${msg.msg_type.data}, zeek::TYPE_COUNT));
@@ -244,7 +244,7 @@ refine connection KRB_Conn += {
 		bro_analyzer()->ProtocolConfirmation();
 		if ( krb_error )
 			{
-			auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Error_Msg);
+			auto rv = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Error_Msg);
 			proc_error_arguments(rv.get(), ${msg.args1}, 0);
 			rv->Assign(4, asn1_integer_to_val(${msg.error_code}, zeek::TYPE_COUNT));
 			proc_error_arguments(rv.get(), ${msg.args2}, binary_to_int64(${msg.error_code.encoding.content}));
@@ -258,7 +258,7 @@ refine connection KRB_Conn += {
 		bro_analyzer()->ProtocolConfirmation();
 		if ( krb_ap_request )
 			{
-			auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::AP_Options);
+			auto rv = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::KRB::AP_Options);
 			rv->Assign(0, val_mgr->Bool(${msg.ap_options.use_session_key}));
 			rv->Assign(1, val_mgr->Bool(${msg.ap_options.mutual_required}));
 
@@ -289,7 +289,7 @@ refine connection KRB_Conn += {
 		bro_analyzer()->ProtocolConfirmation();
 		if ( krb_safe )
 			{
-			auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::SAFE_Msg);
+			auto rv = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::KRB::SAFE_Msg);
 
 			rv->Assign(0, asn1_integer_to_val(${msg.pvno.data}, zeek::TYPE_COUNT));
 			rv->Assign(1, asn1_integer_to_val(${msg.msg_type.data}, zeek::TYPE_COUNT));
diff --git a/src/analyzer/protocol/krb/krb-asn1.pac b/src/analyzer/protocol/krb/krb-asn1.pac
index 5619ca285f..ad83f0c22c 100644
--- a/src/analyzer/protocol/krb/krb-asn1.pac
+++ b/src/analyzer/protocol/krb/krb-asn1.pac
@@ -2,20 +2,20 @@
 %include ../asn1/asn1.pac
 
 %header{
-    IntrusivePtr<Val> GetTimeFromAsn1(const KRB_Time* atime, int64 usecs);
-    IntrusivePtr<Val> GetTimeFromAsn1(StringVal* atime, int64 usecs);
+    zeek::IntrusivePtr<Val> GetTimeFromAsn1(const KRB_Time* atime, int64 usecs);
+    zeek::IntrusivePtr<Val> GetTimeFromAsn1(StringVal* atime, int64 usecs);
 %}
 
 %code{
 
-IntrusivePtr<Val> GetTimeFromAsn1(const KRB_Time* atime, int64 usecs)
+zeek::IntrusivePtr<Val> GetTimeFromAsn1(const KRB_Time* atime, int64 usecs)
 	{
 	auto atime_bytestring = to_stringval(atime->time());
 	auto result = GetTimeFromAsn1(atime_bytestring.get(), usecs);
 	return result;
 	}
 
-IntrusivePtr<Val> GetTimeFromAsn1(StringVal* atime, int64 usecs)
+zeek::IntrusivePtr<Val> GetTimeFromAsn1(StringVal* atime, int64 usecs)
 	{
 	time_t lResult = 0;
 
@@ -51,7 +51,7 @@ IntrusivePtr<Val> GetTimeFromAsn1(StringVal* atime, int64 usecs)
 	if ( !lResult )
 		lResult = 0;
 
-	return make_intrusive<TimeVal>(double(lResult + double(usecs/100000.0)));
+	return zeek::make_intrusive<TimeVal>(double(lResult + double(usecs/100000.0)));
 	}
 
 %}
diff --git a/src/analyzer/protocol/krb/krb-padata.pac b/src/analyzer/protocol/krb/krb-padata.pac
index 003fb43e7b..79a8877ae9 100644
--- a/src/analyzer/protocol/krb/krb-padata.pac
+++ b/src/analyzer/protocol/krb/krb-padata.pac
@@ -7,13 +7,13 @@
 %}
 
 %header{
-IntrusivePtr<VectorVal> proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro_analyzer, bool is_error);
+zeek::IntrusivePtr<VectorVal> proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro_analyzer, bool is_error);
 %}
 
 %code{
-IntrusivePtr<VectorVal> proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro_analyzer, bool is_error)
+zeek::IntrusivePtr<VectorVal> proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro_analyzer, bool is_error)
 {
-	auto vv = make_intrusive<VectorVal>(zeek::id::find_type<zeek::VectorType>("KRB::Type_Value_Vector"));
+	auto vv = zeek::make_intrusive<VectorVal>(zeek::id::find_type<zeek::VectorType>("KRB::Type_Value_Vector"));
 
 	if ( ! data->data()->has_padata() )
 		return vv;
@@ -36,7 +36,7 @@ IntrusivePtr<VectorVal> proc_padata(const KRB_PA_Data_Sequence* data, const BroA
 				break;
 			case PA_PW_SALT:
 				{
-				auto type_val = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Type_Value);
+				auto type_val = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Type_Value);
 				type_val->Assign(0, val_mgr->Count(element->data_type()));
 				type_val->Assign(1, to_stringval(element->pa_data_element()->pa_pw_salt()->encoding()->content()));
 				vv->Assign(vv->Size(), std::move(type_val));
@@ -44,7 +44,7 @@ IntrusivePtr<VectorVal> proc_padata(const KRB_PA_Data_Sequence* data, const BroA
 				}
 			case PA_ENCTYPE_INFO:
 				{
-				auto type_val = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Type_Value);
+				auto type_val = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Type_Value);
 				type_val->Assign(0, val_mgr->Count(element->data_type()));
 				type_val->Assign(1, to_stringval(element->pa_data_element()->pf_enctype_info()->salt()));
 				vv->Assign(vv->Size(), std::move(type_val));
@@ -52,7 +52,7 @@ IntrusivePtr<VectorVal> proc_padata(const KRB_PA_Data_Sequence* data, const BroA
 				}
 			case PA_ENCTYPE_INFO2:
 				{
-				auto type_val = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Type_Value);
+				auto type_val = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Type_Value);
 				type_val->Assign(0, val_mgr->Count(element->data_type()));
 				type_val->Assign(1, to_stringval(element->pa_data_element()->pf_enctype_info2()->salt()));
 				vv->Assign(vv->Size(), std::move(type_val));
@@ -110,7 +110,7 @@ IntrusivePtr<VectorVal> proc_padata(const KRB_PA_Data_Sequence* data, const BroA
 				{
 				if ( ! is_error && element->pa_data_element()->unknown()->meta()->length() > 0 )
 					{
-					auto type_val = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Type_Value);
+					auto type_val = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Type_Value);
 					type_val->Assign(0, val_mgr->Count(element->data_type()));
 					type_val->Assign(1, to_stringval(element->pa_data_element()->unknown()->content()));
 					vv->Assign(vv->Size(), std::move(type_val));
diff --git a/src/analyzer/protocol/krb/krb-types.pac b/src/analyzer/protocol/krb/krb-types.pac
index f9c3e24d84..9181a0e02b 100644
--- a/src/analyzer/protocol/krb/krb-types.pac
+++ b/src/analyzer/protocol/krb/krb-types.pac
@@ -1,41 +1,41 @@
 # Fundamental KRB types
 
 %header{
-IntrusivePtr<Val> GetStringFromPrincipalName(const KRB_Principal_Name* pname);
+zeek::IntrusivePtr<Val> GetStringFromPrincipalName(const KRB_Principal_Name* pname);
 
-IntrusivePtr<VectorVal> proc_cipher_list(const Array* list);
+zeek::IntrusivePtr<VectorVal> proc_cipher_list(const Array* list);
 
-IntrusivePtr<VectorVal> proc_host_address_list(const BroAnalyzer a, const KRB_Host_Addresses* list);
-IntrusivePtr<RecordVal> proc_host_address(const BroAnalyzer a, const KRB_Host_Address* addr);
+zeek::IntrusivePtr<VectorVal> proc_host_address_list(const BroAnalyzer a, const KRB_Host_Addresses* list);
+zeek::IntrusivePtr<RecordVal> proc_host_address(const BroAnalyzer a, const KRB_Host_Address* addr);
 
-IntrusivePtr<VectorVal> proc_tickets(const KRB_Ticket_Sequence* list);
-IntrusivePtr<RecordVal> proc_ticket(const KRB_Ticket* ticket);
+zeek::IntrusivePtr<VectorVal> proc_tickets(const KRB_Ticket_Sequence* list);
+zeek::IntrusivePtr<RecordVal> proc_ticket(const KRB_Ticket* ticket);
 %}
 
 %code{
-IntrusivePtr<Val> GetStringFromPrincipalName(const KRB_Principal_Name* pname)
+zeek::IntrusivePtr<Val> GetStringFromPrincipalName(const KRB_Principal_Name* pname)
 {
 	if ( pname->data()->size() == 1 )
 		return to_stringval(pname->data()[0][0]->encoding()->content());
 	if ( pname->data()->size() == 2 )
-		return make_intrusive<StringVal>(fmt("%s/%s", (char *) pname->data()[0][0]->encoding()->content().begin(), (char *)pname->data()[0][1]->encoding()->content().begin()));
+		return zeek::make_intrusive<StringVal>(fmt("%s/%s", (char *) pname->data()[0][0]->encoding()->content().begin(), (char *)pname->data()[0][1]->encoding()->content().begin()));
 	if ( pname->data()->size() == 3 ) // if the name-string has a third value, this will just append it, else this will return unknown as the principal name
-		return make_intrusive<StringVal>(fmt("%s/%s/%s", (char *) pname->data()[0][0]->encoding()->content().begin(), (char *)pname->data()[0][1]->encoding()->content().begin(), (char *)pname->data()[0][2]->encoding()->content().begin()));
+		return zeek::make_intrusive<StringVal>(fmt("%s/%s/%s", (char *) pname->data()[0][0]->encoding()->content().begin(), (char *)pname->data()[0][1]->encoding()->content().begin(), (char *)pname->data()[0][2]->encoding()->content().begin()));
 
-	return make_intrusive<StringVal>("unknown");
+	return zeek::make_intrusive<StringVal>("unknown");
 }
 
-IntrusivePtr<VectorVal> proc_cipher_list(const Array* list)
+zeek::IntrusivePtr<VectorVal> proc_cipher_list(const Array* list)
 {
-	auto ciphers = make_intrusive<VectorVal>(zeek::id::index_vec);
+	auto ciphers = zeek::make_intrusive<VectorVal>(zeek::id::index_vec);
 	for ( uint i = 0; i < list->data()->size(); ++i )
 		ciphers->Assign(ciphers->Size(), asn1_integer_to_val((*list->data())[i], zeek::TYPE_COUNT));
 	return ciphers;
 }
 
-IntrusivePtr<VectorVal> proc_host_address_list(const BroAnalyzer a, const KRB_Host_Addresses* list)
+zeek::IntrusivePtr<VectorVal> proc_host_address_list(const BroAnalyzer a, const KRB_Host_Addresses* list)
 {
-	auto addrs = make_intrusive<VectorVal>(zeek::id::find_type<zeek::VectorType>("KRB::Host_Address_Vector"));
+	auto addrs = zeek::make_intrusive<VectorVal>(zeek::id::find_type<zeek::VectorType>("KRB::Host_Address_Vector"));
 
 	for ( uint i = 0; i < list->addresses()->size(); ++i )
 		{
@@ -45,9 +45,9 @@ IntrusivePtr<VectorVal> proc_host_address_list(const BroAnalyzer a, const KRB_Ho
 	return addrs;
 }
 
-IntrusivePtr<RecordVal> proc_host_address(const BroAnalyzer a, const KRB_Host_Address* addr)
+zeek::IntrusivePtr<RecordVal> proc_host_address(const BroAnalyzer a, const KRB_Host_Address* addr)
 {
-	auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Host_Address);
+	auto rv = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Host_Address);
 	const auto& addr_bytes = addr->address()->data()->content();
 
 	switch ( binary_to_int64(addr->addr_type()->encoding()->content()) )
@@ -61,7 +61,7 @@ IntrusivePtr<RecordVal> proc_host_address(const BroAnalyzer a, const KRB_Host_Ad
 				}
 
 			auto bytes = reinterpret_cast<const uint32_t*>(addr_bytes.data());
-			rv->Assign(0, make_intrusive<AddrVal>(IPAddr(IPv4, bytes, IPAddr::Network)));
+			rv->Assign(0, zeek::make_intrusive<AddrVal>(IPAddr(IPv4, bytes, IPAddr::Network)));
 			return rv;
 			}
 		case 24:
@@ -73,7 +73,7 @@ IntrusivePtr<RecordVal> proc_host_address(const BroAnalyzer a, const KRB_Host_Ad
 				}
 
 			auto bytes = reinterpret_cast<const uint32_t*>(addr_bytes.data());
-			rv->Assign(0, make_intrusive<AddrVal>(IPAddr(IPv6, bytes, IPAddr::Network)));
+			rv->Assign(0, zeek::make_intrusive<AddrVal>(IPAddr(IPv6, bytes, IPAddr::Network)));
 			return rv;
 			}
 		case 20:
@@ -85,16 +85,16 @@ IntrusivePtr<RecordVal> proc_host_address(const BroAnalyzer a, const KRB_Host_Ad
 			break;
 		}
 
-	auto unk = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Type_Value);
+	auto unk = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Type_Value);
 	unk->Assign(0, asn1_integer_to_val(addr->addr_type(), zeek::TYPE_COUNT));
 	unk->Assign(1, to_stringval(addr_bytes));
 	rv->Assign(2, std::move(unk));
 	return rv;
 }
 
-IntrusivePtr<VectorVal> proc_tickets(const KRB_Ticket_Sequence* list)
+zeek::IntrusivePtr<VectorVal> proc_tickets(const KRB_Ticket_Sequence* list)
 	{
-	auto tickets = make_intrusive<VectorVal>(zeek::id::find_type<zeek::VectorType>("KRB::Ticket_Vector"));
+	auto tickets = zeek::make_intrusive<VectorVal>(zeek::id::find_type<zeek::VectorType>("KRB::Ticket_Vector"));
 
 	for ( uint i = 0; i < list->tickets()->size(); ++i )
 		{
@@ -105,9 +105,9 @@ IntrusivePtr<VectorVal> proc_tickets(const KRB_Ticket_Sequence* list)
 	return tickets;
 	}
 
-IntrusivePtr<RecordVal> proc_ticket(const KRB_Ticket* ticket)
+zeek::IntrusivePtr<RecordVal> proc_ticket(const KRB_Ticket* ticket)
 	{
-	auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Ticket);
+	auto rv = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Ticket);
 
 	rv->Assign(0, asn1_integer_to_val(ticket->tkt_vno()->data(), zeek::TYPE_COUNT));
 	rv->Assign(1, to_stringval(ticket->realm()->data()->content()));
diff --git a/src/analyzer/protocol/login/Login.cc b/src/analyzer/protocol/login/Login.cc
index 63d9c12541..de309f34b2 100644
--- a/src/analyzer/protocol/login/Login.cc
+++ b/src/analyzer/protocol/login/Login.cc
@@ -45,13 +45,13 @@ Login_Analyzer::Login_Analyzer(const char* name, Connection* conn)
 
 	if ( ! re_skip_authentication )
 		{
-		IntrusivePtr<ListVal> skip_authentication = zeek::id::find_val("skip_authentication")->AsTableVal()->ToPureListVal();
-		IntrusivePtr<ListVal> direct_login_prompts = zeek::id::find_val("direct_login_prompts")->AsTableVal()->ToPureListVal();
-		IntrusivePtr<ListVal> login_prompts = zeek::id::find_val("login_prompts")->AsTableVal()->ToPureListVal();
-		IntrusivePtr<ListVal> login_non_failure_msgs = zeek::id::find_val("login_non_failure_msgs")->AsTableVal()->ToPureListVal();
-		IntrusivePtr<ListVal> login_failure_msgs = zeek::id::find_val("login_failure_msgs")->AsTableVal()->ToPureListVal();
-		IntrusivePtr<ListVal> login_success_msgs = zeek::id::find_val("login_success_msgs")->AsTableVal()->ToPureListVal();
-		IntrusivePtr<ListVal> login_timeouts = zeek::id::find_val("login_timeouts")->AsTableVal()->ToPureListVal();
+		zeek::IntrusivePtr<ListVal> skip_authentication = zeek::id::find_val("skip_authentication")->AsTableVal()->ToPureListVal();
+		zeek::IntrusivePtr<ListVal> direct_login_prompts = zeek::id::find_val("direct_login_prompts")->AsTableVal()->ToPureListVal();
+		zeek::IntrusivePtr<ListVal> login_prompts = zeek::id::find_val("login_prompts")->AsTableVal()->ToPureListVal();
+		zeek::IntrusivePtr<ListVal> login_non_failure_msgs = zeek::id::find_val("login_non_failure_msgs")->AsTableVal()->ToPureListVal();
+		zeek::IntrusivePtr<ListVal> login_failure_msgs = zeek::id::find_val("login_failure_msgs")->AsTableVal()->ToPureListVal();
+		zeek::IntrusivePtr<ListVal> login_success_msgs = zeek::id::find_val("login_success_msgs")->AsTableVal()->ToPureListVal();
+		zeek::IntrusivePtr<ListVal> login_timeouts = zeek::id::find_val("login_timeouts")->AsTableVal()->ToPureListVal();
 
 #ifdef USE_PERFTOOLS_DEBUG
 		HeapLeakChecker::Disabler disabler;
@@ -342,19 +342,19 @@ void Login_Analyzer::SetEnv(bool orig, char* name, char* val)
 		else if ( login_terminal && streq(name, "TERM") )
 			EnqueueConnEvent(login_terminal,
 				ConnVal(),
-				make_intrusive<StringVal>(val)
+				zeek::make_intrusive<StringVal>(val)
 			);
 
 		else if ( login_display && streq(name, "DISPLAY") )
 			EnqueueConnEvent(login_display,
 				ConnVal(),
-				make_intrusive<StringVal>(val)
+				zeek::make_intrusive<StringVal>(val)
 			);
 
 		else if ( login_prompt && streq(name, "TTYPROMPT") )
 			EnqueueConnEvent(login_prompt,
 				ConnVal(),
-				make_intrusive<StringVal>(val)
+				zeek::make_intrusive<StringVal>(val)
 			);
 		}
 
@@ -430,11 +430,11 @@ void Login_Analyzer::LoginEvent(EventHandlerPtr f, const char* line,
 
 	EnqueueConnEvent(f,
 		ConnVal(),
-		IntrusivePtr{NewRef{}, username},
-		client_name ? IntrusivePtr{NewRef{}, client_name}
+		zeek::IntrusivePtr{zeek::NewRef{}, username},
+		client_name ? zeek::IntrusivePtr{zeek::NewRef{}, client_name}
 		            : val_mgr->EmptyString(),
-		IntrusivePtr{AdoptRef{}, password},
-		make_intrusive<StringVal>(line)
+		zeek::IntrusivePtr{zeek::AdoptRef{}, password},
+		zeek::make_intrusive<StringVal>(line)
 	);
 	}
 
@@ -453,7 +453,7 @@ void Login_Analyzer::LineEvent(EventHandlerPtr f, const char* line)
 
 	EnqueueConnEvent(f,
 		ConnVal(),
-		make_intrusive<StringVal>(line)
+		zeek::make_intrusive<StringVal>(line)
 	);
 	}
 
@@ -465,8 +465,8 @@ void Login_Analyzer::Confused(const char* msg, const char* line)
 	if ( login_confused )
 		EnqueueConnEvent(login_confused,
 			ConnVal(),
-			make_intrusive<StringVal>(msg),
-			make_intrusive<StringVal>(line)
+			zeek::make_intrusive<StringVal>(msg),
+			zeek::make_intrusive<StringVal>(line)
 		);
 
 	if ( login_confused_text )
@@ -489,7 +489,7 @@ void Login_Analyzer::ConfusionText(const char* line)
 	if ( login_confused_text )
 		EnqueueConnEvent(login_confused_text,
 			ConnVal(),
-			make_intrusive<StringVal>(line)
+			zeek::make_intrusive<StringVal>(line)
 		);
 	}
 
diff --git a/src/analyzer/protocol/login/NVT.cc b/src/analyzer/protocol/login/NVT.cc
index 230c09ba16..6336a0229b 100644
--- a/src/analyzer/protocol/login/NVT.cc
+++ b/src/analyzer/protocol/login/NVT.cc
@@ -461,7 +461,7 @@ void NVT_Analyzer::SetTerminal(const u_char* terminal, int len)
 	if ( login_terminal )
 		EnqueueConnEvent(login_terminal,
 			ConnVal(),
-			make_intrusive<StringVal>(new BroString(terminal, len, false))
+			zeek::make_intrusive<StringVal>(new BroString(terminal, len, false))
 		);
 	}
 
diff --git a/src/analyzer/protocol/login/RSH.cc b/src/analyzer/protocol/login/RSH.cc
index 3827cbd2f8..73c331bf31 100644
--- a/src/analyzer/protocol/login/RSH.cc
+++ b/src/analyzer/protocol/login/RSH.cc
@@ -175,16 +175,16 @@ void Rsh_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
 	vl.emplace_back(ConnVal());
 
 	if ( client_name )
-		vl.emplace_back(NewRef{}, client_name);
+		vl.emplace_back(zeek::NewRef{}, client_name);
 	else
-		vl.emplace_back(make_intrusive<StringVal>("<none>"));
+		vl.emplace_back(zeek::make_intrusive<StringVal>("<none>"));
 
 	if ( username )
-		vl.emplace_back(NewRef{}, username);
+		vl.emplace_back(zeek::NewRef{}, username);
 	else
-		vl.emplace_back(make_intrusive<StringVal>("<none>"));
+		vl.emplace_back(zeek::make_intrusive<StringVal>("<none>"));
 
-	vl.emplace_back(make_intrusive<StringVal>(line));
+	vl.emplace_back(zeek::make_intrusive<StringVal>(line));
 
 	if ( orig )
 		{
diff --git a/src/analyzer/protocol/login/Rlogin.cc b/src/analyzer/protocol/login/Rlogin.cc
index f2dd23f2ab..70cf4b9719 100644
--- a/src/analyzer/protocol/login/Rlogin.cc
+++ b/src/analyzer/protocol/login/Rlogin.cc
@@ -132,7 +132,7 @@ void Contents_Rlogin_Analyzer::DoDeliver(int len, const u_char* data)
 					}
 				}
 			else
-				{ 
+				{
 				// Unknown control, or we're confused.
 				// Put back what we've consumed.
 				unsigned char buf[64];
@@ -246,6 +246,6 @@ void Rlogin_Analyzer::TerminalType(const char* s)
 	if ( login_terminal )
 		EnqueueConnEvent(login_terminal,
 			ConnVal(),
-			make_intrusive<StringVal>(s)
+			zeek::make_intrusive<StringVal>(s)
 		);
 	}
diff --git a/src/analyzer/protocol/mime/MIME.cc b/src/analyzer/protocol/mime/MIME.cc
index 377d272bfa..a7dfa0d7db 100644
--- a/src/analyzer/protocol/mime/MIME.cc
+++ b/src/analyzer/protocol/mime/MIME.cc
@@ -117,17 +117,17 @@ StringVal* new_string_val(const char* data, const char* end_of_data)
 StringVal* new_string_val(const data_chunk_t buf)
 	{ return to_string_val(buf).release(); }
 
-IntrusivePtr<StringVal> to_string_val(int length, const char* data)
+zeek::IntrusivePtr<StringVal> to_string_val(int length, const char* data)
 	{
-	return make_intrusive<StringVal>(length, data);
+	return zeek::make_intrusive<StringVal>(length, data);
 	}
 
-IntrusivePtr<StringVal> to_string_val(const char* data, const char* end_of_data)
+zeek::IntrusivePtr<StringVal> to_string_val(const char* data, const char* end_of_data)
 	{
-	return make_intrusive<StringVal>(end_of_data - data, data);
+	return zeek::make_intrusive<StringVal>(end_of_data - data, data);
 	}
 
-IntrusivePtr<StringVal> to_string_val(const data_chunk_t buf)
+zeek::IntrusivePtr<StringVal> to_string_val(const data_chunk_t buf)
 	{
 	return to_string_val(buf.length, buf.data);
 	}
@@ -560,8 +560,8 @@ void MIME_Entity::init()
 
 	need_to_parse_parameters = 0;
 
-	content_type_str = make_intrusive<StringVal>("TEXT");
-	content_subtype_str = make_intrusive<StringVal>("PLAIN");
+	content_type_str = zeek::make_intrusive<StringVal>("TEXT");
+	content_subtype_str = zeek::make_intrusive<StringVal>("PLAIN");
 
 	content_encoding_str = nullptr;
 	multipart_boundary = nullptr;
@@ -811,9 +811,9 @@ bool MIME_Entity::ParseContentTypeField(MIME_Header* h)
 	data += offset;
 	len -= offset;
 
-	content_type_str = make_intrusive<StringVal>(ty.length, ty.data);
+	content_type_str = zeek::make_intrusive<StringVal>(ty.length, ty.data);
 	content_type_str->ToUpper();
-	content_subtype_str = make_intrusive<StringVal>(subty.length, subty.data);
+	content_subtype_str = zeek::make_intrusive<StringVal>(subty.length, subty.data);
 	content_subtype_str->ToUpper();
 
 	ParseContentType(ty, subty);
@@ -1301,10 +1301,10 @@ void MIME_Entity::DebugPrintHeaders()
 RecordVal* MIME_Message::BuildHeaderVal(MIME_Header* h)
 	{ return ToHeaderVal(h).release(); }
 
-IntrusivePtr<RecordVal> MIME_Message::ToHeaderVal(MIME_Header* h)
+zeek::IntrusivePtr<RecordVal> MIME_Message::ToHeaderVal(MIME_Header* h)
 	{
 	static auto mime_header_rec = zeek::id::find_type<zeek::RecordType>("mime_header_rec");
-	auto header_record = make_intrusive<RecordVal>(mime_header_rec);
+	auto header_record = zeek::make_intrusive<RecordVal>(mime_header_rec);
 	header_record->Assign(0, to_string_val(h->get_name()));
 	auto upper_hn = to_string_val(h->get_name());
 	upper_hn->ToUpper();
@@ -1316,10 +1316,10 @@ IntrusivePtr<RecordVal> MIME_Message::ToHeaderVal(MIME_Header* h)
 TableVal* MIME_Message::BuildHeaderTable(MIME_HeaderList& hlist)
 	{ return ToHeaderTable(hlist).release(); }
 
-IntrusivePtr<TableVal> MIME_Message::ToHeaderTable(MIME_HeaderList& hlist)
+zeek::IntrusivePtr<TableVal> MIME_Message::ToHeaderTable(MIME_HeaderList& hlist)
 	{
 	static auto mime_header_list = zeek::id::find_type<zeek::TableType>("mime_header_list");
-	auto t = make_intrusive<TableVal>(mime_header_list);
+	auto t = zeek::make_intrusive<TableVal>(mime_header_list);
 
 	for ( unsigned int i = 0; i < hlist.size(); ++i )
 		{
@@ -1383,7 +1383,7 @@ void MIME_Mail::Done()
 		analyzer->EnqueueConnEvent(mime_content_hash,
 			analyzer->ConnVal(),
 			val_mgr->Count(content_hash_length),
-			make_intrusive<StringVal>(new BroString(true, digest, 16))
+			zeek::make_intrusive<StringVal>(new BroString(true, digest, 16))
 		);
 		}
 
@@ -1423,7 +1423,7 @@ void MIME_Mail::EndEntity(MIME_Entity* /* entity */)
 		analyzer->EnqueueConnEvent(mime_entity_data,
 			analyzer->ConnVal(),
 			val_mgr->Count(s->Len()),
-			make_intrusive<StringVal>(s)
+			zeek::make_intrusive<StringVal>(s)
 		);
 
 		if ( ! mime_all_data )
@@ -1490,7 +1490,7 @@ void MIME_Mail::SubmitData(int len, const char* buf)
 		analyzer->EnqueueConnEvent(mime_segment_data,
 			analyzer->ConnVal(),
 			val_mgr->Count(data_len),
-			make_intrusive<StringVal>(data_len, data)
+			zeek::make_intrusive<StringVal>(data_len, data)
 		);
 		}
 
@@ -1537,7 +1537,7 @@ void MIME_Mail::SubmitAllData()
 		analyzer->EnqueueConnEvent(mime_all_data,
 			analyzer->ConnVal(),
 			val_mgr->Count(s->Len()),
-			make_intrusive<StringVal>(s)
+			zeek::make_intrusive<StringVal>(s)
 		);
 		}
 	}
@@ -1564,7 +1564,7 @@ void MIME_Mail::SubmitEvent(int event_type, const char* detail)
 	if ( mime_event )
 		analyzer->EnqueueConnEvent(mime_event,
 			analyzer->ConnVal(),
-			make_intrusive<StringVal>(category),
-			make_intrusive<StringVal>(detail)
+			zeek::make_intrusive<StringVal>(category),
+			zeek::make_intrusive<StringVal>(detail)
 		);
 	}
diff --git a/src/analyzer/protocol/mime/MIME.h b/src/analyzer/protocol/mime/MIME.h
index bfea4ef6a2..4597b63da5 100644
--- a/src/analyzer/protocol/mime/MIME.h
+++ b/src/analyzer/protocol/mime/MIME.h
@@ -102,8 +102,8 @@ public:
 	StringVal* ContentType() const { return content_type_str.get(); }
 	[[deprecated("Remove in v4.1.  Use GetContentSubType().")]]
 	StringVal* ContentSubType() const { return content_subtype_str.get(); }
-	const IntrusivePtr<StringVal>& GetContentType() const { return content_type_str; }
-	const IntrusivePtr<StringVal>& GetContentSubType() const { return content_subtype_str; }
+	const zeek::IntrusivePtr<StringVal>& GetContentType() const { return content_type_str; }
+	const zeek::IntrusivePtr<StringVal>& GetContentSubType() const { return content_subtype_str; }
 	int ContentTransferEncoding() const { return content_encoding; }
 
 protected:
@@ -159,8 +159,8 @@ protected:
 	int current_field_type;
 	int need_to_parse_parameters;
 
-	IntrusivePtr<StringVal> content_type_str;
-	IntrusivePtr<StringVal> content_subtype_str;
+	zeek::IntrusivePtr<StringVal> content_type_str;
+	zeek::IntrusivePtr<StringVal> content_subtype_str;
 	BroString* content_encoding_str;
 	BroString* multipart_boundary;
 
@@ -235,8 +235,8 @@ protected:
 	[[deprecated("Remove in v4.1.  Use ToHeaderTable().")]]
 	TableVal* BuildHeaderTable(MIME_HeaderList& hlist);
 
-	IntrusivePtr<RecordVal> ToHeaderVal(MIME_Header* h);
-	IntrusivePtr<TableVal> ToHeaderTable(MIME_HeaderList& hlist);
+	zeek::IntrusivePtr<RecordVal> ToHeaderVal(MIME_Header* h);
+	zeek::IntrusivePtr<TableVal> ToHeaderTable(MIME_HeaderList& hlist);
 };
 
 class MIME_Mail final : public MIME_Message {
@@ -281,9 +281,9 @@ extern StringVal* new_string_val(int length, const char* data);
 extern StringVal* new_string_val(const char* data, const char* end_of_data);
 [[deprecated("Remove in v4.1.  Use analyzer::mime::to_string_val().")]]
 extern StringVal* new_string_val(const data_chunk_t buf);
-extern IntrusivePtr<StringVal> to_string_val(int length, const char* data);
-extern IntrusivePtr<StringVal> to_string_val(const char* data, const char* end_of_data);
-extern IntrusivePtr<StringVal> to_string_val(const data_chunk_t buf);
+extern zeek::IntrusivePtr<StringVal> to_string_val(int length, const char* data);
+extern zeek::IntrusivePtr<StringVal> to_string_val(const char* data, const char* end_of_data);
+extern zeek::IntrusivePtr<StringVal> to_string_val(const data_chunk_t buf);
 extern int fputs(data_chunk_t b, FILE* fp);
 extern bool istrequal(data_chunk_t s, const char* t);
 extern bool is_lws(char ch);
diff --git a/src/analyzer/protocol/modbus/modbus-analyzer.pac b/src/analyzer/protocol/modbus/modbus-analyzer.pac
index 06271c82e6..968f28cd23 100644
--- a/src/analyzer/protocol/modbus/modbus-analyzer.pac
+++ b/src/analyzer/protocol/modbus/modbus-analyzer.pac
@@ -8,15 +8,15 @@
 #
 
 %header{
-	IntrusivePtr<VectorVal> bytestring_to_coils(const bytestring& coils, uint quantity);
-	IntrusivePtr<RecordVal> HeaderToVal(ModbusTCP_TransportHeader* header);
-	IntrusivePtr<VectorVal> create_vector_of_count();
+	zeek::IntrusivePtr<VectorVal> bytestring_to_coils(const bytestring& coils, uint quantity);
+	zeek::IntrusivePtr<RecordVal> HeaderToVal(ModbusTCP_TransportHeader* header);
+	zeek::IntrusivePtr<VectorVal> create_vector_of_count();
 	%}
 
 %code{
-	IntrusivePtr<VectorVal> bytestring_to_coils(const bytestring& coils, uint quantity)
+	zeek::IntrusivePtr<VectorVal> bytestring_to_coils(const bytestring& coils, uint quantity)
 		{
-		auto modbus_coils = make_intrusive<VectorVal>(zeek::BifType::Vector::ModbusCoils);
+		auto modbus_coils = zeek::make_intrusive<VectorVal>(zeek::BifType::Vector::ModbusCoils);
 
 		for ( uint i = 0; i < quantity; i++ )
 			{
@@ -27,9 +27,9 @@
 		return modbus_coils;
 		}
 
-	IntrusivePtr<RecordVal> HeaderToVal(ModbusTCP_TransportHeader* header)
+	zeek::IntrusivePtr<RecordVal> HeaderToVal(ModbusTCP_TransportHeader* header)
 		{
-		auto modbus_header = make_intrusive<RecordVal>(zeek::BifType::Record::ModbusHeaders);
+		auto modbus_header = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::ModbusHeaders);
 		modbus_header->Assign(0, val_mgr->Count(header->tid()));
 		modbus_header->Assign(1, val_mgr->Count(header->pid()));
 		modbus_header->Assign(2, val_mgr->Count(header->uid()));
@@ -37,10 +37,10 @@
 		return modbus_header;
 		}
 
-	IntrusivePtr<VectorVal> create_vector_of_count()
+	zeek::IntrusivePtr<VectorVal> create_vector_of_count()
 		{
-		auto vt = make_intrusive<zeek::VectorType>(zeek::base_type(zeek::TYPE_COUNT));
-		auto vv = make_intrusive<VectorVal>(std::move(vt));
+		auto vt = zeek::make_intrusive<zeek::VectorType>(zeek::base_type(zeek::TYPE_COUNT));
+		auto vv = zeek::make_intrusive<VectorVal>(std::move(vt));
 		return vv;
 		}
 
@@ -209,7 +209,7 @@ refine flow ModbusTCP_Flow += {
 
 		if ( ::modbus_read_holding_registers_response )
 			{
-			auto t = make_intrusive<VectorVal>(zeek::BifType::Vector::ModbusRegisters);
+			auto t = zeek::make_intrusive<VectorVal>(zeek::BifType::Vector::ModbusRegisters);
 
 			for ( unsigned int i=0; i < ${message.registers}->size(); ++i )
 				{
@@ -253,7 +253,7 @@ refine flow ModbusTCP_Flow += {
 
 		if ( ::modbus_read_input_registers_response )
 			{
-			auto t = make_intrusive<VectorVal>(zeek::BifType::Vector::ModbusRegisters);
+			auto t = zeek::make_intrusive<VectorVal>(zeek::BifType::Vector::ModbusRegisters);
 
 			for ( unsigned int i=0; i < (${message.registers})->size(); ++i )
 				{
@@ -397,7 +397,7 @@ refine flow ModbusTCP_Flow += {
 
 		if ( ::modbus_write_multiple_registers_request )
 			{
-			auto t = make_intrusive<VectorVal>(zeek::BifType::Vector::ModbusRegisters);
+			auto t = zeek::make_intrusive<VectorVal>(zeek::BifType::Vector::ModbusRegisters);
 
 			for ( unsigned int i = 0; i < (${message.registers}->size()); ++i )
 				{
@@ -582,7 +582,7 @@ refine flow ModbusTCP_Flow += {
 
 		if ( ::modbus_read_write_multiple_registers_request )
 			{
-			auto t = make_intrusive<VectorVal>(zeek::BifType::Vector::ModbusRegisters);
+			auto t = zeek::make_intrusive<VectorVal>(zeek::BifType::Vector::ModbusRegisters);
 
 			for ( unsigned int i = 0; i < ${message.write_register_values}->size(); ++i )
 				{
@@ -614,7 +614,7 @@ refine flow ModbusTCP_Flow += {
 
 		if ( ::modbus_read_write_multiple_registers_response )
 			{
-			auto t = make_intrusive<VectorVal>(zeek::BifType::Vector::ModbusRegisters);
+			auto t = zeek::make_intrusive<VectorVal>(zeek::BifType::Vector::ModbusRegisters);
 
 			for ( unsigned int i = 0; i < ${message.registers}->size(); ++i )
 				{
diff --git a/src/analyzer/protocol/mqtt/commands/connack.pac b/src/analyzer/protocol/mqtt/commands/connack.pac
index c2954efa8a..d2dd9e68ef 100644
--- a/src/analyzer/protocol/mqtt/commands/connack.pac
+++ b/src/analyzer/protocol/mqtt/commands/connack.pac
@@ -15,7 +15,7 @@ refine flow MQTT_Flow += {
 		%{
 		if ( mqtt_connack )
 			{
-			auto m = make_intrusive<RecordVal>(zeek::BifType::Record::MQTT::ConnectAckMsg);
+			auto m = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::MQTT::ConnectAckMsg);
 			m->Assign(0, val_mgr->Count(${msg.return_code}));
 			m->Assign(1, val_mgr->Bool(${msg.session_present}));
 			zeek::BifEvent::enqueue_mqtt_connack(connection()->bro_analyzer(),
diff --git a/src/analyzer/protocol/mqtt/commands/connect.pac b/src/analyzer/protocol/mqtt/commands/connect.pac
index 407313cc8a..15d732141c 100644
--- a/src/analyzer/protocol/mqtt/commands/connect.pac
+++ b/src/analyzer/protocol/mqtt/commands/connect.pac
@@ -44,13 +44,13 @@ refine flow MQTT_Flow += {
 		%{
 		if ( mqtt_connect )
 			{
-			auto m = make_intrusive<RecordVal>(zeek::BifType::Record::MQTT::ConnectMsg);
-			m->Assign(0, make_intrusive<StringVal>(${msg.protocol_name.str}.length(),
+			auto m = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::MQTT::ConnectMsg);
+			m->Assign(0, zeek::make_intrusive<StringVal>(${msg.protocol_name.str}.length(),
 			                           reinterpret_cast<const char*>(${msg.protocol_name.str}.begin())));
 			m->Assign(1, val_mgr->Count(${msg.protocol_version}));
-			m->Assign(2, make_intrusive<StringVal>(${msg.client_id.str}.length(),
+			m->Assign(2, zeek::make_intrusive<StringVal>(${msg.client_id.str}.length(),
 			                           reinterpret_cast<const char*>(${msg.client_id.str}.begin())));
-			m->Assign(3, make_intrusive<IntervalVal>(double(${msg.keep_alive}), Seconds));
+			m->Assign(3, zeek::make_intrusive<IntervalVal>(double(${msg.keep_alive}), Seconds));
 
 			m->Assign(4, val_mgr->Bool(${msg.clean_session}));
 			m->Assign(5, val_mgr->Bool(${msg.will_retain}));
@@ -58,20 +58,20 @@ refine flow MQTT_Flow += {
 
 			if ( ${msg.will_flag} )
 				{
-				m->Assign(7, make_intrusive<StringVal>(${msg.will.topic.str}.length(),
+				m->Assign(7, zeek::make_intrusive<StringVal>(${msg.will.topic.str}.length(),
 				                           reinterpret_cast<const char*>(${msg.will.topic.str}.begin())));
-				m->Assign(8, make_intrusive<StringVal>(${msg.will.msg.str}.length(),
+				m->Assign(8, zeek::make_intrusive<StringVal>(${msg.will.msg.str}.length(),
 				                           reinterpret_cast<const char*>(${msg.will.msg.str}.begin())));
 				}
 
 			if ( ${msg.username} )
 				{
-				m->Assign(9, make_intrusive<StringVal>(${msg.uname.str}.length(),
+				m->Assign(9, zeek::make_intrusive<StringVal>(${msg.uname.str}.length(),
 				                           reinterpret_cast<const char*>(${msg.uname.str}.begin())));
 				}
 			if ( ${msg.password} )
 				{
-				m->Assign(10, make_intrusive<StringVal>(${msg.pass.str}.length(),
+				m->Assign(10, zeek::make_intrusive<StringVal>(${msg.pass.str}.length(),
 				                            reinterpret_cast<const char*>(${msg.pass.str}.begin())));
 				}
 
diff --git a/src/analyzer/protocol/mqtt/commands/publish.pac b/src/analyzer/protocol/mqtt/commands/publish.pac
index cd7ceef2b3..0748278756 100644
--- a/src/analyzer/protocol/mqtt/commands/publish.pac
+++ b/src/analyzer/protocol/mqtt/commands/publish.pac
@@ -23,7 +23,7 @@ refine flow MQTT_Flow += {
 		%{
 		if ( mqtt_publish )
 			{
-			auto m = make_intrusive<RecordVal>(zeek::BifType::Record::MQTT::PublishMsg);
+			auto m = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::MQTT::PublishMsg);
 			m->Assign(0, val_mgr->Bool(${msg.dup}));
 			m->Assign(1, val_mgr->Count(${msg.qos}));
 			m->Assign(2, val_mgr->Bool(${msg.retain}));
diff --git a/src/analyzer/protocol/mqtt/commands/subscribe.pac b/src/analyzer/protocol/mqtt/commands/subscribe.pac
index 755101b41f..6d0f667906 100644
--- a/src/analyzer/protocol/mqtt/commands/subscribe.pac
+++ b/src/analyzer/protocol/mqtt/commands/subscribe.pac
@@ -19,12 +19,12 @@ refine flow MQTT_Flow += {
 		%{
 		if ( mqtt_subscribe )
 			{
-			auto topics = make_intrusive<VectorVal>(zeek::id::string_vec);
-			auto qos_levels = make_intrusive<VectorVal>(zeek::id::index_vec);
+			auto topics = zeek::make_intrusive<VectorVal>(zeek::id::string_vec);
+			auto qos_levels = zeek::make_intrusive<VectorVal>(zeek::id::index_vec);
 
 			for ( auto topic: *${msg.topics} )
 				{
-				auto subscribe_topic = make_intrusive<StringVal>(${topic.name.str}.length(),
+				auto subscribe_topic = zeek::make_intrusive<StringVal>(${topic.name.str}.length(),
 				                                     reinterpret_cast<const char*>(${topic.name.str}.begin()));
 				auto qos = val_mgr->Count(${topic.requested_QoS});
 				topics->Assign(topics->Size(), std::move(subscribe_topic));
diff --git a/src/analyzer/protocol/mqtt/commands/unsubscribe.pac b/src/analyzer/protocol/mqtt/commands/unsubscribe.pac
index 944e005c7b..7bf6b2b931 100644
--- a/src/analyzer/protocol/mqtt/commands/unsubscribe.pac
+++ b/src/analyzer/protocol/mqtt/commands/unsubscribe.pac
@@ -14,11 +14,11 @@ refine flow MQTT_Flow += {
 		%{
 		if ( mqtt_unsubscribe )
 			{
-			auto topics = make_intrusive<VectorVal>(zeek::id::string_vec);
+			auto topics = zeek::make_intrusive<VectorVal>(zeek::id::string_vec);
 
 			for ( auto topic: *${msg.topics} )
 				{
-				auto unsubscribe_topic = make_intrusive<StringVal>(${topic.str}.length(),
+				auto unsubscribe_topic = zeek::make_intrusive<StringVal>(${topic.str}.length(),
 				                                  reinterpret_cast<const char*>(${topic.str}.begin()));
 				topics->Assign(topics->Size(), std::move(unsubscribe_topic));
 				}
diff --git a/src/analyzer/protocol/mysql/mysql-analyzer.pac b/src/analyzer/protocol/mysql/mysql-analyzer.pac
index 8c94ecdec6..c02a1d1e8e 100644
--- a/src/analyzer/protocol/mysql/mysql-analyzer.pac
+++ b/src/analyzer/protocol/mysql/mysql-analyzer.pac
@@ -8,11 +8,11 @@ refine flow MySQL_Flow += {
 			if ( ${msg.version} == 10 )
 				zeek::BifEvent::enqueue_mysql_server_version(connection()->bro_analyzer(),
 				                                       connection()->bro_analyzer()->Conn(),
-				                                       make_intrusive<StringVal>(c_str(${msg.handshake10.server_version})));
+				                                       zeek::make_intrusive<StringVal>(c_str(${msg.handshake10.server_version})));
 			if ( ${msg.version} == 9 )
 				zeek::BifEvent::enqueue_mysql_server_version(connection()->bro_analyzer(),
 				                                       connection()->bro_analyzer()->Conn(),
-				                                       make_intrusive<StringVal>(c_str(${msg.handshake9.server_version})));
+				                                       zeek::make_intrusive<StringVal>(c_str(${msg.handshake9.server_version})));
 			}
 		return true;
 		%}
@@ -27,11 +27,11 @@ refine flow MySQL_Flow += {
 			if ( ${msg.version} == 10 )
 				zeek::BifEvent::enqueue_mysql_handshake(connection()->bro_analyzer(),
 				                                  connection()->bro_analyzer()->Conn(),
-				                                  make_intrusive<StringVal>(c_str(${msg.v10_response.username})));
+				                                  zeek::make_intrusive<StringVal>(c_str(${msg.v10_response.username})));
 			if ( ${msg.version} == 9 )
 				zeek::BifEvent::enqueue_mysql_handshake(connection()->bro_analyzer(),
 				                                  connection()->bro_analyzer()->Conn(),
-				                                  make_intrusive<StringVal>(c_str(${msg.v9_response.username})));
+				                                  zeek::make_intrusive<StringVal>(c_str(${msg.v9_response.username})));
 			}
 		return true;
 		%}
@@ -83,11 +83,11 @@ refine flow MySQL_Flow += {
 			return true;
 
 		auto vt = zeek::id::string_vec;
-		auto vv = make_intrusive<VectorVal>(std::move(vt));
+		auto vv = zeek::make_intrusive<VectorVal>(std::move(vt));
 
 		auto& bstring = ${msg.row.first_field.val};
 		auto ptr = reinterpret_cast<const char*>(bstring.data());
-		vv->Assign(vv->Size(), make_intrusive<StringVal>(bstring.length(), ptr));
+		vv->Assign(vv->Size(), zeek::make_intrusive<StringVal>(bstring.length(), ptr));
 
 		auto& fields = *${msg.row.fields};
 
@@ -95,7 +95,7 @@ refine flow MySQL_Flow += {
 			{
 			auto& bstring = f->val();
 			auto ptr = reinterpret_cast<const char*>(bstring.data());
-			vv->Assign(vv->Size(), make_intrusive<StringVal>(bstring.length(), ptr));
+			vv->Assign(vv->Size(), zeek::make_intrusive<StringVal>(bstring.length(), ptr));
 			}
 
 		zeek::BifEvent::enqueue_mysql_result_row(connection()->bro_analyzer(),
diff --git a/src/analyzer/protocol/netbios/NetbiosSSN.cc b/src/analyzer/protocol/netbios/NetbiosSSN.cc
index 2fa240b752..8872afa781 100644
--- a/src/analyzer/protocol/netbios/NetbiosSSN.cc
+++ b/src/analyzer/protocol/netbios/NetbiosSSN.cc
@@ -324,12 +324,12 @@ void NetbiosSSN_Interpreter::Event(EventHandlerPtr event, const u_char* data,
 		analyzer->EnqueueConnEvent(event,
 			analyzer->ConnVal(),
 			val_mgr->Bool(is_orig),
-			make_intrusive<StringVal>(new BroString(data, len, false))
+			zeek::make_intrusive<StringVal>(new BroString(data, len, false))
 		);
 	else
 		analyzer->EnqueueConnEvent(event,
 			analyzer->ConnVal(),
-			make_intrusive<StringVal>(new BroString(data, len, false))
+			zeek::make_intrusive<StringVal>(new BroString(data, len, false))
 		);
 	}
 
diff --git a/src/analyzer/protocol/netbios/functions.bif b/src/analyzer/protocol/netbios/functions.bif
index f4c145a9ae..0bd3f59cf1 100644
--- a/src/analyzer/protocol/netbios/functions.bif
+++ b/src/analyzer/protocol/netbios/functions.bif
@@ -34,7 +34,7 @@ function decode_netbios_name%(name: string%): string
 			break;
 		}
 
-	return make_intrusive<StringVal>(i, result);
+	return zeek::make_intrusive<StringVal>(i, result);
 	%}
 
 ## Converts a NetBIOS name type to its corresponding numeric value.
diff --git a/src/analyzer/protocol/ntlm/ntlm-analyzer.pac b/src/analyzer/protocol/ntlm/ntlm-analyzer.pac
index 7b4f38e288..9aa4d7b63d 100644
--- a/src/analyzer/protocol/ntlm/ntlm-analyzer.pac
+++ b/src/analyzer/protocol/ntlm/ntlm-analyzer.pac
@@ -1,25 +1,25 @@
 %header{
-	IntrusivePtr<Val> filetime2brotime(uint64_t ts);
-	IntrusivePtr<RecordVal> build_version_record(NTLM_Version* val);
-	IntrusivePtr<RecordVal> build_negotiate_flag_record(NTLM_Negotiate_Flags* val);
+	zeek::IntrusivePtr<Val> filetime2brotime(uint64_t ts);
+	zeek::IntrusivePtr<RecordVal> build_version_record(NTLM_Version* val);
+	zeek::IntrusivePtr<RecordVal> build_negotiate_flag_record(NTLM_Negotiate_Flags* val);
 %}
 
 %code{
 	// This is replicated from the SMB analyzer. :(
-	IntrusivePtr<Val> filetime2brotime(uint64_t ts)
+	zeek::IntrusivePtr<Val> filetime2brotime(uint64_t ts)
 		{
 		double secs = (ts / 10000000.0);
 
 		// Bro can't support times back to the 1600's
 		// so we subtract a lot of seconds.
-		auto bro_ts = make_intrusive<TimeVal>(secs - 11644473600.0);
+		auto bro_ts = zeek::make_intrusive<TimeVal>(secs - 11644473600.0);
 
 		return bro_ts;
 		}
 
-	IntrusivePtr<RecordVal> build_version_record(NTLM_Version* val)
+	zeek::IntrusivePtr<RecordVal> build_version_record(NTLM_Version* val)
 		{
-		auto result = make_intrusive<RecordVal>(zeek::BifType::Record::NTLM::Version);
+		auto result = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NTLM::Version);
 		result->Assign(0, val_mgr->Count(${val.major_version}));
 		result->Assign(1, val_mgr->Count(${val.minor_version}));
 		result->Assign(2, val_mgr->Count(${val.build_number}));
@@ -28,9 +28,9 @@
 		return result;
 		}
 
-	IntrusivePtr<RecordVal> build_negotiate_flag_record(NTLM_Negotiate_Flags* val)
+	zeek::IntrusivePtr<RecordVal> build_negotiate_flag_record(NTLM_Negotiate_Flags* val)
 		{
-		auto flags = make_intrusive<RecordVal>(zeek::BifType::Record::NTLM::NegotiateFlags);
+		auto flags = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NTLM::NegotiateFlags);
 		flags->Assign(0, val_mgr->Bool(${val.negotiate_56}));
 		flags->Assign(1, val_mgr->Bool(${val.negotiate_key_exch}));
 		flags->Assign(2, val_mgr->Bool(${val.negotiate_128}));
@@ -117,7 +117,7 @@ refine connection NTLM_Conn += {
 		if ( ! ntlm_negotiate )
 			return true;
 
-		auto result = make_intrusive<RecordVal>(zeek::BifType::Record::NTLM::Negotiate);
+		auto result = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NTLM::Negotiate);
 		result->Assign(0, build_negotiate_flag_record(${val.flags}));
 
 		if ( ${val}->has_domain_name() )
@@ -141,7 +141,7 @@ refine connection NTLM_Conn += {
 		if ( ! ntlm_challenge )
 			return true;
 
-		auto result = make_intrusive<RecordVal>(zeek::BifType::Record::NTLM::Challenge);
+		auto result = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NTLM::Challenge);
 		result->Assign(0, build_negotiate_flag_record(${val.flags}));
 
 		if ( ${val}->has_target_name() )
@@ -151,7 +151,7 @@ refine connection NTLM_Conn += {
 			result->Assign(2, build_version_record(${val.version}));
 
 		if ( ${val}->has_target_info() )
-			result->Assign(3, {AdoptRef{}, build_av_record(${val.target_info},  ${val.target_info_fields.length})});
+			result->Assign(3, {zeek::AdoptRef{}, build_av_record(${val.target_info},  ${val.target_info_fields.length})});
 
 		zeek::BifEvent::enqueue_ntlm_challenge(bro_analyzer(),
 		                                 bro_analyzer()->Conn(),
@@ -165,7 +165,7 @@ refine connection NTLM_Conn += {
 		if ( ! ntlm_authenticate )
 			return true;
 
-		auto result = make_intrusive<RecordVal>(zeek::BifType::Record::NTLM::Authenticate);
+		auto result = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NTLM::Authenticate);
 		result->Assign(0, build_negotiate_flag_record(${val.flags}));
 
 		if ( ${val}->has_domain_name() > 0 )
diff --git a/src/analyzer/protocol/ntp/ntp-analyzer.pac b/src/analyzer/protocol/ntp/ntp-analyzer.pac
index 1e08505da4..68704fe86b 100644
--- a/src/analyzer/protocol/ntp/ntp-analyzer.pac
+++ b/src/analyzer/protocol/ntp/ntp-analyzer.pac
@@ -8,37 +8,37 @@
 %}
 
 %header{
-	IntrusivePtr<Val> proc_ntp_short(const NTP_Short_Time* t);
-	IntrusivePtr<Val> proc_ntp_timestamp(const NTP_Time* t);
-	IntrusivePtr<RecordVal> BuildNTPStdMsg(NTP_std_msg* nsm);
-	IntrusivePtr<RecordVal> BuildNTPControlMsg(NTP_control_msg* ncm);
-	IntrusivePtr<RecordVal> BuildNTPMode7Msg(NTP_mode7_msg* m7);
+	zeek::IntrusivePtr<Val> proc_ntp_short(const NTP_Short_Time* t);
+	zeek::IntrusivePtr<Val> proc_ntp_timestamp(const NTP_Time* t);
+	zeek::IntrusivePtr<RecordVal> BuildNTPStdMsg(NTP_std_msg* nsm);
+	zeek::IntrusivePtr<RecordVal> BuildNTPControlMsg(NTP_control_msg* ncm);
+	zeek::IntrusivePtr<RecordVal> BuildNTPMode7Msg(NTP_mode7_msg* m7);
 %}
 
 
 %code{
-	IntrusivePtr<Val> proc_ntp_short(const NTP_Short_Time* t)
+	zeek::IntrusivePtr<Val> proc_ntp_short(const NTP_Short_Time* t)
 		{
 		if ( t->seconds() == 0 && t->fractions() == 0 )
-			return make_intrusive<IntervalVal>(0.0);
-		return make_intrusive<IntervalVal>(t->seconds() + t->fractions()*FRAC_16);
+			return zeek::make_intrusive<IntervalVal>(0.0);
+		return zeek::make_intrusive<IntervalVal>(t->seconds() + t->fractions()*FRAC_16);
 		}
 
-	IntrusivePtr<Val> proc_ntp_timestamp(const NTP_Time* t)
+	zeek::IntrusivePtr<Val> proc_ntp_timestamp(const NTP_Time* t)
 		{
 		if ( t->seconds() == 0 && t->fractions() == 0)
-			return make_intrusive<TimeVal>(0.0);
-		return make_intrusive<TimeVal>(EPOCH_OFFSET + t->seconds() + t->fractions()*FRAC_32);
+			return zeek::make_intrusive<TimeVal>(0.0);
+		return zeek::make_intrusive<TimeVal>(EPOCH_OFFSET + t->seconds() + t->fractions()*FRAC_32);
 		}
 
 	// This builds the standard msg record
-	IntrusivePtr<RecordVal> BuildNTPStdMsg(NTP_std_msg* nsm)
+	zeek::IntrusivePtr<RecordVal> BuildNTPStdMsg(NTP_std_msg* nsm)
 		{
-		auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::NTP::StandardMessage);
+		auto rv = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NTP::StandardMessage);
 
 		rv->Assign(0, val_mgr->Count(${nsm.stratum}));
-		rv->Assign(1, make_intrusive<IntervalVal>(pow(2, ${nsm.poll})));
-		rv->Assign(2, make_intrusive<IntervalVal>(pow(2, ${nsm.precision})));
+		rv->Assign(1, zeek::make_intrusive<IntervalVal>(pow(2, ${nsm.poll})));
+		rv->Assign(2, zeek::make_intrusive<IntervalVal>(pow(2, ${nsm.precision})));
 		rv->Assign(3, proc_ntp_short(${nsm.root_delay}));
 		rv->Assign(4, proc_ntp_short(${nsm.root_dispersion}));
 
@@ -54,7 +54,7 @@
 		default:
 			{
 			const uint8* d = ${nsm.reference_id}.data();
-			rv->Assign(7, make_intrusive<AddrVal>(IPAddr(IPv4, (const uint32*) d, IPAddr::Network)));
+			rv->Assign(7, zeek::make_intrusive<AddrVal>(IPAddr(IPv4, (const uint32*) d, IPAddr::Network)));
 			}
 			break;
 		}
@@ -85,9 +85,9 @@
 		}
 
 	// This builds the control msg record
-	IntrusivePtr<RecordVal> BuildNTPControlMsg(NTP_control_msg* ncm)
+	zeek::IntrusivePtr<RecordVal> BuildNTPControlMsg(NTP_control_msg* ncm)
 		{
-		auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::NTP::ControlMessage);
+		auto rv = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NTP::ControlMessage);
 
 		rv->Assign(0, val_mgr->Count(${ncm.OpCode}));
 		rv->Assign(1, val_mgr->Bool(${ncm.R}));
@@ -110,9 +110,9 @@
 		}
 
 	// This builds the mode7 msg record
-	IntrusivePtr<RecordVal> BuildNTPMode7Msg(NTP_mode7_msg* m7)
+	zeek::IntrusivePtr<RecordVal> BuildNTPMode7Msg(NTP_mode7_msg* m7)
 		{
-		auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::NTP::Mode7Message);
+		auto rv = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NTP::Mode7Message);
 
 		rv->Assign(0, val_mgr->Count(${m7.request_code}));
 		rv->Assign(1, val_mgr->Bool(${m7.auth_bit}));
@@ -138,7 +138,7 @@ refine flow NTP_Flow += {
 		if ( ! ntp_message )
 			return false;
 
-		auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::NTP::Message);
+		auto rv = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NTP::Message);
 		rv->Assign(0, val_mgr->Count(${msg.version}));
 		rv->Assign(1, val_mgr->Count(${msg.mode}));
 
diff --git a/src/analyzer/protocol/pop3/POP3.cc b/src/analyzer/protocol/pop3/POP3.cc
index b73c2532ad..238cf8ebb6 100644
--- a/src/analyzer/protocol/pop3/POP3.cc
+++ b/src/analyzer/protocol/pop3/POP3.cc
@@ -923,9 +923,9 @@ void POP3_Analyzer::POP3Event(EventHandlerPtr event, bool is_orig,
 	vl.emplace_back(val_mgr->Bool(is_orig));
 
 	if ( arg1 )
-		vl.emplace_back(make_intrusive<StringVal>(arg1));
+		vl.emplace_back(zeek::make_intrusive<StringVal>(arg1));
 	if ( arg2 )
-		vl.emplace_back(make_intrusive<StringVal>(arg2));
+		vl.emplace_back(zeek::make_intrusive<StringVal>(arg2));
 
 	EnqueueConnEvent(event, std::move(vl));
 	}
diff --git a/src/analyzer/protocol/radius/radius-analyzer.pac b/src/analyzer/protocol/radius/radius-analyzer.pac
index 02c500e676..d1885e3bad 100644
--- a/src/analyzer/protocol/radius/radius-analyzer.pac
+++ b/src/analyzer/protocol/radius/radius-analyzer.pac
@@ -7,14 +7,14 @@ refine flow RADIUS_Flow += {
 		if ( ! radius_message )
 			return false;
 
-		auto result = make_intrusive<RecordVal>(zeek::BifType::Record::RADIUS::Message);
+		auto result = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::RADIUS::Message);
 		result->Assign(0, val_mgr->Count(${msg.code}));
 		result->Assign(1, val_mgr->Count(${msg.trans_id}));
 		result->Assign(2, to_stringval(${msg.authenticator}));
 
 		if ( ${msg.attributes}->size() )
 			{
-			auto attributes = make_intrusive<TableVal>(zeek::BifType::Table::RADIUS::Attributes);
+			auto attributes = zeek::make_intrusive<TableVal>(zeek::BifType::Table::RADIUS::Attributes);
 
 			for ( uint i = 0; i < ${msg.attributes}->size(); ++i )
 				{
@@ -22,7 +22,7 @@ refine flow RADIUS_Flow += {
 
 				// Do we already have a vector of attributes for this type?
 				auto current = attributes->FindOrDefault(index);
-				IntrusivePtr<Val> val = to_stringval(${msg.attributes[i].value});
+				zeek::IntrusivePtr<Val> val = to_stringval(${msg.attributes[i].value});
 
 				if ( current )
 					{
@@ -32,7 +32,7 @@ refine flow RADIUS_Flow += {
 
 				else
 					{
-					auto attribute_list = make_intrusive<VectorVal>(zeek::BifType::Vector::RADIUS::AttributeList);
+					auto attribute_list = zeek::make_intrusive<VectorVal>(zeek::BifType::Vector::RADIUS::AttributeList);
 					attribute_list->Assign((unsigned int)0, std::move(val));
 					attributes->Assign(std::move(index), std::move(attribute_list));
 					}
diff --git a/src/analyzer/protocol/rdp/rdp-analyzer.pac b/src/analyzer/protocol/rdp/rdp-analyzer.pac
index 4f1f9ef39a..209de1f012 100644
--- a/src/analyzer/protocol/rdp/rdp-analyzer.pac
+++ b/src/analyzer/protocol/rdp/rdp-analyzer.pac
@@ -64,7 +64,7 @@ refine flow RDP_Flow += {
 
 		if ( rdp_client_core_data )
 			{
-			auto ec_flags = make_intrusive<RecordVal>(zeek::BifType::Record::RDP::EarlyCapabilityFlags);
+			auto ec_flags = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::RDP::EarlyCapabilityFlags);
 			ec_flags->Assign(0, val_mgr->Bool(${ccore.SUPPORT_ERRINFO_PDU}));
 			ec_flags->Assign(1, val_mgr->Bool(${ccore.WANT_32BPP_SESSION}));
 			ec_flags->Assign(2, val_mgr->Bool(${ccore.SUPPORT_STATUSINFO_PDU}));
@@ -75,7 +75,7 @@ refine flow RDP_Flow += {
 			ec_flags->Assign(7, val_mgr->Bool(${ccore.SUPPORT_DYNAMIC_TIME_ZONE}));
 			ec_flags->Assign(8, val_mgr->Bool(${ccore.SUPPORT_HEARTBEAT_PDU}));
 
-			auto ccd = make_intrusive<RecordVal>(zeek::BifType::Record::RDP::ClientCoreData);
+			auto ccd = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::RDP::ClientCoreData);
 			ccd->Assign(0, val_mgr->Count(${ccore.version_major}));
 			ccd->Assign(1, val_mgr->Count(${ccore.version_minor}));
 			ccd->Assign(2, val_mgr->Count(${ccore.desktop_width}));
@@ -110,7 +110,7 @@ refine flow RDP_Flow += {
 		if ( ! rdp_client_security_data )
 			return false;
 
-		auto csd = make_intrusive<RecordVal>(zeek::BifType::Record::RDP::ClientSecurityData);
+		auto csd = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::RDP::ClientSecurityData);
 		csd->Assign(0, val_mgr->Count(${csec.encryption_methods}));
 		csd->Assign(1, val_mgr->Count(${csec.ext_encryption_methods}));
 
@@ -127,11 +127,11 @@ refine flow RDP_Flow += {
 
 		if ( ${cnetwork.channel_def_array}->size() )
 			{
-			auto channels = make_intrusive<VectorVal>(zeek::BifType::Vector::RDP::ClientChannelList);
+			auto channels = zeek::make_intrusive<VectorVal>(zeek::BifType::Vector::RDP::ClientChannelList);
 
 			for ( uint i = 0; i < ${cnetwork.channel_def_array}->size(); ++i )
 				{
-				auto channel_def = make_intrusive<RecordVal>(zeek::BifType::Record::RDP::ClientChannelDef);
+				auto channel_def = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::RDP::ClientChannelDef);
 
 				channel_def->Assign(0, to_stringval(${cnetwork.channel_def_array[i].name}));
 				channel_def->Assign(1, val_mgr->Count(${cnetwork.channel_def_array[i].options}));
@@ -164,7 +164,7 @@ refine flow RDP_Flow += {
 		if ( ! rdp_client_cluster_data )
 			return false;
 
-		auto ccld = make_intrusive<RecordVal>(zeek::BifType::Record::RDP::ClientClusterData);
+		auto ccld = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::RDP::ClientClusterData);
 		ccld->Assign(0, val_mgr->Count(${ccluster.flags}));
 		ccld->Assign(1, val_mgr->Count(${ccluster.redir_session_id}));
 		ccld->Assign(2, val_mgr->Bool(${ccluster.REDIRECTION_SUPPORTED}));
@@ -269,4 +269,3 @@ refine typeattr Server_Certificate += &let {
 refine typeattr X509_Cert_Data += &let {
 	proc: bool = $context.flow.proc_x509_cert_data(this);
 };
-
diff --git a/src/analyzer/protocol/rfb/rfb-analyzer.pac b/src/analyzer/protocol/rfb/rfb-analyzer.pac
index b3e99e1af2..31fc358fe7 100644
--- a/src/analyzer/protocol/rfb/rfb-analyzer.pac
+++ b/src/analyzer/protocol/rfb/rfb-analyzer.pac
@@ -52,7 +52,7 @@ refine flow RFB_Flow += {
 			auto name_ptr = &((*vec_ptr)[0]);
 			zeek::BifEvent::enqueue_rfb_server_parameters(
 			    connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(),
-			    make_intrusive<StringVal>(${msg.name}->size(), (const char*)name_ptr),
+			    zeek::make_intrusive<StringVal>(${msg.name}->size(), (const char*)name_ptr),
 			    ${msg.width},
 			    ${msg.height});
 			}
diff --git a/src/analyzer/protocol/rpc/MOUNT.cc b/src/analyzer/protocol/rpc/MOUNT.cc
index 2e9d2d46bd..58f0d74cd9 100644
--- a/src/analyzer/protocol/rpc/MOUNT.cc
+++ b/src/analyzer/protocol/rpc/MOUNT.cc
@@ -22,7 +22,7 @@ bool MOUNT_Interp::RPC_BuildCall(RPC_CallInfo* c, const u_char*& buf, int& n)
 
 	uint32_t proc = c->Proc();
 	// The call arguments, depends on the call type obviously ...
-	IntrusivePtr<RecordVal> callarg;
+	zeek::IntrusivePtr<RecordVal> callarg;
 
 	switch ( proc ) {
 		case BifEnum::MOUNT3::PROC_NULL:
@@ -69,7 +69,7 @@ bool MOUNT_Interp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status rpc_statu
 			       double last_time, int reply_len)
 	{
 	EventHandlerPtr event = nullptr;
-	IntrusivePtr<Val> reply;
+	zeek::IntrusivePtr<Val> reply;
 	BifEnum::MOUNT3::status_t mount_status = BifEnum::MOUNT3::MNT3_OK;
 	bool rpc_success = ( rpc_status == BifEnum::RPC_SUCCESS );
 
@@ -177,40 +177,40 @@ zeek::Args MOUNT_Interp::event_common_vl(RPC_CallInfo *c,
 	zeek::Args vl;
 	vl.reserve(2 + extra_elements);
 	vl.emplace_back(analyzer->ConnVal());
-	auto auxgids = make_intrusive<VectorVal>(zeek::id::index_vec);
+	auto auxgids = zeek::make_intrusive<VectorVal>(zeek::id::index_vec);
 
 	for (size_t i = 0; i < c->AuxGIDs().size(); ++i)
 		{
 		auxgids->Assign(i, val_mgr->Count(c->AuxGIDs()[i]));
 		}
 
-	auto info = make_intrusive<RecordVal>(zeek::BifType::Record::MOUNT3::info_t);
+	auto info = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::MOUNT3::info_t);
 	info->Assign(0, zeek::BifType::Enum::rpc_status->GetVal(rpc_status));
 	info->Assign(1, zeek::BifType::Enum::MOUNT3::status_t->GetVal(mount_status));
-	info->Assign(2, make_intrusive<TimeVal>(c->StartTime()));
-	info->Assign(3, make_intrusive<IntervalVal>(c->LastTime() - c->StartTime()));
+	info->Assign(2, zeek::make_intrusive<TimeVal>(c->StartTime()));
+	info->Assign(3, zeek::make_intrusive<IntervalVal>(c->LastTime() - c->StartTime()));
 	info->Assign(4, val_mgr->Count(c->RPCLen()));
-	info->Assign(5, make_intrusive<TimeVal>(rep_start_time));
-	info->Assign(6, make_intrusive<IntervalVal>(rep_last_time - rep_start_time));
+	info->Assign(5, zeek::make_intrusive<TimeVal>(rep_start_time));
+	info->Assign(6, zeek::make_intrusive<IntervalVal>(rep_last_time - rep_start_time));
 	info->Assign(7, val_mgr->Count(reply_len));
 	info->Assign(8, val_mgr->Count(c->Uid()));
 	info->Assign(9, val_mgr->Count(c->Gid()));
 	info->Assign(10, val_mgr->Count(c->Stamp()));
-	info->Assign(11, make_intrusive<StringVal>(c->MachineName()));
+	info->Assign(11, zeek::make_intrusive<StringVal>(c->MachineName()));
 	info->Assign(12, std::move(auxgids));
 
 	vl.emplace_back(std::move(info));
 	return vl;
 	}
 
-IntrusivePtr<EnumVal> MOUNT_Interp::mount3_auth_flavor(const u_char*& buf, int& n)
+zeek::IntrusivePtr<EnumVal> MOUNT_Interp::mount3_auth_flavor(const u_char*& buf, int& n)
     {
 	BifEnum::MOUNT3::auth_flavor_t t = (BifEnum::MOUNT3::auth_flavor_t)extract_XDR_uint32(buf, n);
 	auto rval = zeek::BifType::Enum::MOUNT3::auth_flavor_t->GetVal(t);
 	return rval;
     }
 
-IntrusivePtr<StringVal> MOUNT_Interp::mount3_fh(const u_char*& buf, int& n)
+zeek::IntrusivePtr<StringVal> MOUNT_Interp::mount3_fh(const u_char*& buf, int& n)
 	{
 	int fh_n;
 	const u_char* fh = extract_XDR_opaque(buf, n, fh_n, 64);
@@ -218,10 +218,10 @@ IntrusivePtr<StringVal> MOUNT_Interp::mount3_fh(const u_char*& buf, int& n)
 	if ( ! fh )
 		return nullptr;
 
-	return make_intrusive<StringVal>(new BroString(fh, fh_n, false));
+	return zeek::make_intrusive<StringVal>(new BroString(fh, fh_n, false));
 	}
 
-IntrusivePtr<StringVal> MOUNT_Interp::mount3_filename(const u_char*& buf, int& n)
+zeek::IntrusivePtr<StringVal> MOUNT_Interp::mount3_filename(const u_char*& buf, int& n)
 	{
 	int name_len;
 	const u_char* name = extract_XDR_opaque(buf, n, name_len);
@@ -229,20 +229,20 @@ IntrusivePtr<StringVal> MOUNT_Interp::mount3_filename(const u_char*& buf, int& n
 	if ( ! name )
 		return nullptr;
 
-	return make_intrusive<StringVal>(new BroString(name, name_len, false));
+	return zeek::make_intrusive<StringVal>(new BroString(name, name_len, false));
 	}
 
-IntrusivePtr<RecordVal> MOUNT_Interp::mount3_dirmntargs(const u_char*& buf, int& n)
+zeek::IntrusivePtr<RecordVal> MOUNT_Interp::mount3_dirmntargs(const u_char*& buf, int& n)
 	{
-	auto dirmntargs = make_intrusive<RecordVal>(zeek::BifType::Record::MOUNT3::dirmntargs_t);
+	auto dirmntargs = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::MOUNT3::dirmntargs_t);
 	dirmntargs->Assign(0, mount3_filename(buf, n));
 	return dirmntargs;
 	}
 
-IntrusivePtr<RecordVal> MOUNT_Interp::mount3_mnt_reply(const u_char*& buf, int& n,
+zeek::IntrusivePtr<RecordVal> MOUNT_Interp::mount3_mnt_reply(const u_char*& buf, int& n,
 		     BifEnum::MOUNT3::status_t status)
 	{
-	auto rep = make_intrusive<RecordVal>(zeek::BifType::Record::MOUNT3::mnt_reply_t);
+	auto rep = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::MOUNT3::mnt_reply_t);
 
 	if ( status == BifEnum::MOUNT3::MNT3_OK )
 		{
@@ -258,8 +258,8 @@ IntrusivePtr<RecordVal> MOUNT_Interp::mount3_mnt_reply(const u_char*& buf, int&
 			auth_flavors_count = max_auth_flavors;
 			}
 
-		auto enum_vector = make_intrusive<zeek::VectorType>(zeek::base_type(zeek::TYPE_ENUM));
-		auto auth_flavors = make_intrusive<VectorVal>(std::move(enum_vector));
+		auto enum_vector = zeek::make_intrusive<zeek::VectorType>(zeek::base_type(zeek::TYPE_ENUM));
+		auto auth_flavors = zeek::make_intrusive<VectorVal>(std::move(enum_vector));
 
 		for ( auto i = 0u; i < auth_flavors_count; ++i )
 			auth_flavors->Assign(auth_flavors->Size(),
diff --git a/src/analyzer/protocol/rpc/MOUNT.h b/src/analyzer/protocol/rpc/MOUNT.h
index 0409db7404..b275cd2eaa 100644
--- a/src/analyzer/protocol/rpc/MOUNT.h
+++ b/src/analyzer/protocol/rpc/MOUNT.h
@@ -29,12 +29,12 @@ protected:
 	// to 0. However, the methods might still return an allocated Val * !
 	// So, you might want to Unref() the Val if buf is 0. Method names
 	// are based on the type names of RFC 1813.
-	IntrusivePtr<EnumVal>   mount3_auth_flavor(const u_char*& buf, int& n);
-	IntrusivePtr<StringVal> mount3_fh(const u_char*& buf, int& n);
-	IntrusivePtr<RecordVal> mount3_dirmntargs(const u_char*&buf, int &n);
-	IntrusivePtr<StringVal> mount3_filename(const u_char*& buf, int& n);
+	zeek::IntrusivePtr<EnumVal>   mount3_auth_flavor(const u_char*& buf, int& n);
+	zeek::IntrusivePtr<StringVal> mount3_fh(const u_char*& buf, int& n);
+	zeek::IntrusivePtr<RecordVal> mount3_dirmntargs(const u_char*&buf, int &n);
+	zeek::IntrusivePtr<StringVal> mount3_filename(const u_char*& buf, int& n);
 
-	IntrusivePtr<RecordVal> mount3_mnt_reply(const u_char*& buf, int& n, BifEnum::MOUNT3::status_t status);
+	zeek::IntrusivePtr<RecordVal> mount3_mnt_reply(const u_char*& buf, int& n, BifEnum::MOUNT3::status_t status);
 };
 
 class MOUNT_Analyzer : public RPC_Analyzer {
diff --git a/src/analyzer/protocol/rpc/NFS.cc b/src/analyzer/protocol/rpc/NFS.cc
index 97a66f5461..394d3a39e1 100644
--- a/src/analyzer/protocol/rpc/NFS.cc
+++ b/src/analyzer/protocol/rpc/NFS.cc
@@ -22,7 +22,7 @@ bool NFS_Interp::RPC_BuildCall(RPC_CallInfo* c, const u_char*& buf, int& n)
 
 	uint32_t proc = c->Proc();
 	// The call arguments, depends on the call type obviously ...
-	IntrusivePtr<Val> callarg;
+	zeek::IntrusivePtr<Val> callarg;
 
 	switch ( proc ) {
 	case BifEnum::NFS3::PROC_NULL:
@@ -124,7 +124,7 @@ bool NFS_Interp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status rpc_status,
 			       double last_time, int reply_len)
 	{
 	EventHandlerPtr event = nullptr;
-	IntrusivePtr<Val> reply;
+	zeek::IntrusivePtr<Val> reply;
 	BifEnum::NFS3::status_t nfs_status = BifEnum::NFS3::NFS3ERR_OK;
 	bool rpc_success = ( rpc_status == BifEnum::RPC_SUCCESS );
 
@@ -278,7 +278,7 @@ bool NFS_Interp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status rpc_status,
 	return true;
 	}
 
-IntrusivePtr<StringVal> NFS_Interp::nfs3_file_data(const u_char*& buf, int& n, uint64_t offset, int size)
+zeek::IntrusivePtr<StringVal> NFS_Interp::nfs3_file_data(const u_char*& buf, int& n, uint64_t offset, int size)
 	{
 	int data_n;
 
@@ -297,7 +297,7 @@ IntrusivePtr<StringVal> NFS_Interp::nfs3_file_data(const u_char*& buf, int& n, u
 	data_n = std::min(data_n, int(zeek::BifConst::NFS3::return_data_max));
 
 	if ( data && data_n > 0 )
-		return make_intrusive<StringVal>(new BroString(data, data_n, false));
+		return zeek::make_intrusive<StringVal>(new BroString(data, data_n, false));
 
 	return nullptr;
 	}
@@ -312,31 +312,31 @@ zeek::Args NFS_Interp::event_common_vl(RPC_CallInfo *c, BifEnum::rpc_status rpc_
 	zeek::Args vl;
 	vl.reserve(2 + extra_elements);
 	vl.emplace_back(analyzer->ConnVal());
-	auto auxgids = make_intrusive<VectorVal>(zeek::id::index_vec);
+	auto auxgids = zeek::make_intrusive<VectorVal>(zeek::id::index_vec);
 
 	for ( size_t i = 0; i < c->AuxGIDs().size(); ++i )
 		auxgids->Assign(i, val_mgr->Count(c->AuxGIDs()[i]));
 
-	auto info = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::info_t);
+	auto info = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::info_t);
 	info->Assign(0, zeek::BifType::Enum::rpc_status->GetVal(rpc_status));
 	info->Assign(1, zeek::BifType::Enum::NFS3::status_t->GetVal(nfs_status));
-	info->Assign(2, make_intrusive<TimeVal>(c->StartTime()));
-	info->Assign(3, make_intrusive<IntervalVal>(c->LastTime()-c->StartTime()));
+	info->Assign(2, zeek::make_intrusive<TimeVal>(c->StartTime()));
+	info->Assign(3, zeek::make_intrusive<IntervalVal>(c->LastTime()-c->StartTime()));
 	info->Assign(4, val_mgr->Count(c->RPCLen()));
-	info->Assign(5, make_intrusive<TimeVal>(rep_start_time));
-	info->Assign(6, make_intrusive<IntervalVal>(rep_last_time-rep_start_time));
+	info->Assign(5, zeek::make_intrusive<TimeVal>(rep_start_time));
+	info->Assign(6, zeek::make_intrusive<IntervalVal>(rep_last_time-rep_start_time));
 	info->Assign(7, val_mgr->Count(reply_len));
 	info->Assign(8, val_mgr->Count(c->Uid()));
 	info->Assign(9, val_mgr->Count(c->Gid()));
 	info->Assign(10, val_mgr->Count(c->Stamp()));
-	info->Assign(11, make_intrusive<StringVal>(c->MachineName()));
+	info->Assign(11, zeek::make_intrusive<StringVal>(c->MachineName()));
 	info->Assign(12, std::move(auxgids));
 
 	vl.emplace_back(std::move(info));
 	return vl;
 	}
 
-IntrusivePtr<StringVal> NFS_Interp::nfs3_fh(const u_char*& buf, int& n)
+zeek::IntrusivePtr<StringVal> NFS_Interp::nfs3_fh(const u_char*& buf, int& n)
 	{
 	int fh_n;
 	const u_char* fh = extract_XDR_opaque(buf, n, fh_n, 64);
@@ -344,13 +344,13 @@ IntrusivePtr<StringVal> NFS_Interp::nfs3_fh(const u_char*& buf, int& n)
 	if ( ! fh )
 		return nullptr;
 
-	return make_intrusive<StringVal>(new BroString(fh, fh_n, false));
+	return zeek::make_intrusive<StringVal>(new BroString(fh, fh_n, false));
 	}
 
 
-IntrusivePtr<RecordVal> NFS_Interp::nfs3_sattr(const u_char*& buf, int& n)
+zeek::IntrusivePtr<RecordVal> NFS_Interp::nfs3_sattr(const u_char*& buf, int& n)
 	{
-	auto attrs = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::sattr_t);
+	auto attrs = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::sattr_t);
 
 	attrs->Assign(0, nullptr); // mode
 	int mode_set_it =  extract_XDR_uint32(buf, n);
@@ -379,9 +379,9 @@ IntrusivePtr<RecordVal> NFS_Interp::nfs3_sattr(const u_char*& buf, int& n)
 	return attrs;
 	}
 
-IntrusivePtr<RecordVal> NFS_Interp::nfs3_sattr_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status)
+zeek::IntrusivePtr<RecordVal> NFS_Interp::nfs3_sattr_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status)
 	{
-	auto rep = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::sattr_reply_t);
+	auto rep = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::sattr_reply_t);
 
 	if ( status == BifEnum::NFS3::NFS3ERR_OK )
 		{
@@ -397,9 +397,9 @@ IntrusivePtr<RecordVal> NFS_Interp::nfs3_sattr_reply(const u_char*& buf, int& n,
 	return rep;
 	}
 
-IntrusivePtr<RecordVal> NFS_Interp::nfs3_fattr(const u_char*& buf, int& n)
+zeek::IntrusivePtr<RecordVal> NFS_Interp::nfs3_fattr(const u_char*& buf, int& n)
 	{
-	auto attrs = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::fattr_t);
+	auto attrs = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::fattr_t);
 
 	attrs->Assign(0, nfs3_ftype(buf, n));	// file type
 	attrs->Assign(1, ExtractUint32(buf, n));	// mode
@@ -419,23 +419,23 @@ IntrusivePtr<RecordVal> NFS_Interp::nfs3_fattr(const u_char*& buf, int& n)
 	return attrs;
 	}
 
-IntrusivePtr<EnumVal> NFS_Interp::nfs3_time_how(const u_char*& buf, int& n)
+zeek::IntrusivePtr<EnumVal> NFS_Interp::nfs3_time_how(const u_char*& buf, int& n)
 	{
 	BifEnum::NFS3::time_how_t t = (BifEnum::NFS3::time_how_t)extract_XDR_uint32(buf, n);
 	auto rval = zeek::BifType::Enum::NFS3::time_how_t->GetVal(t);
 	return rval;
 	}
 
-IntrusivePtr<EnumVal> NFS_Interp::nfs3_ftype(const u_char*& buf, int& n)
+zeek::IntrusivePtr<EnumVal> NFS_Interp::nfs3_ftype(const u_char*& buf, int& n)
 	{
 	BifEnum::NFS3::file_type_t t = (BifEnum::NFS3::file_type_t)extract_XDR_uint32(buf, n);
 	auto rval = zeek::BifType::Enum::NFS3::file_type_t->GetVal(t);
 	return rval;
 	}
 
-IntrusivePtr<RecordVal> NFS_Interp::nfs3_wcc_attr(const u_char*& buf, int& n)
+zeek::IntrusivePtr<RecordVal> NFS_Interp::nfs3_wcc_attr(const u_char*& buf, int& n)
 	{
-	auto attrs = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::wcc_attr_t);
+	auto attrs = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::wcc_attr_t);
 
 	attrs->Assign(0, ExtractUint64(buf, n));	// size
 	attrs->Assign(1, ExtractTime(buf, n));	// mtime
@@ -444,7 +444,7 @@ IntrusivePtr<RecordVal> NFS_Interp::nfs3_wcc_attr(const u_char*& buf, int& n)
 	return attrs;
 	}
 
-IntrusivePtr<StringVal> NFS_Interp::nfs3_filename(const u_char*& buf, int& n)
+zeek::IntrusivePtr<StringVal> NFS_Interp::nfs3_filename(const u_char*& buf, int& n)
 	{
 	int name_len;
 	const u_char* name = extract_XDR_opaque(buf, n, name_len);
@@ -452,12 +452,12 @@ IntrusivePtr<StringVal> NFS_Interp::nfs3_filename(const u_char*& buf, int& n)
 	if ( ! name )
 		return nullptr;
 
-	return make_intrusive<StringVal>(new BroString(name, name_len, false));
+	return zeek::make_intrusive<StringVal>(new BroString(name, name_len, false));
 	}
 
-IntrusivePtr<RecordVal> NFS_Interp::nfs3_diropargs(const u_char*& buf, int& n)
+zeek::IntrusivePtr<RecordVal> NFS_Interp::nfs3_diropargs(const u_char*& buf, int& n)
 	{
-	auto diropargs = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::diropargs_t);
+	auto diropargs = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::diropargs_t);
 
 	diropargs->Assign(0, nfs3_fh(buf, n));
 	diropargs->Assign(1, nfs3_filename(buf, n));
@@ -465,9 +465,9 @@ IntrusivePtr<RecordVal> NFS_Interp::nfs3_diropargs(const u_char*& buf, int& n)
 	return diropargs;
 	}
 
-IntrusivePtr<RecordVal> NFS_Interp::nfs3_symlinkdata(const u_char*& buf, int& n)
+zeek::IntrusivePtr<RecordVal> NFS_Interp::nfs3_symlinkdata(const u_char*& buf, int& n)
 	{
-	auto symlinkdata = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::symlinkdata_t);
+	auto symlinkdata = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::symlinkdata_t);
 
 	symlinkdata->Assign(0, nfs3_sattr(buf, n));
 	symlinkdata->Assign(1, nfs3_nfspath(buf, n));
@@ -475,9 +475,9 @@ IntrusivePtr<RecordVal> NFS_Interp::nfs3_symlinkdata(const u_char*& buf, int& n)
 	return symlinkdata;
 	}
 
-IntrusivePtr<RecordVal> NFS_Interp::nfs3_renameopargs(const u_char*& buf, int& n)
+zeek::IntrusivePtr<RecordVal> NFS_Interp::nfs3_renameopargs(const u_char*& buf, int& n)
 	{
-	auto renameopargs = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::renameopargs_t);
+	auto renameopargs = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::renameopargs_t);
 
 	renameopargs->Assign(0, nfs3_fh(buf, n));
 	renameopargs->Assign(1, nfs3_filename(buf, n));
@@ -487,7 +487,7 @@ IntrusivePtr<RecordVal> NFS_Interp::nfs3_renameopargs(const u_char*& buf, int& n
 	return renameopargs;
 	}
 
-IntrusivePtr<RecordVal> NFS_Interp::nfs3_post_op_attr(const u_char*& buf, int& n)
+zeek::IntrusivePtr<RecordVal> NFS_Interp::nfs3_post_op_attr(const u_char*& buf, int& n)
 	{
 	int have_attrs = extract_XDR_uint32(buf, n);
 
@@ -497,7 +497,7 @@ IntrusivePtr<RecordVal> NFS_Interp::nfs3_post_op_attr(const u_char*& buf, int& n
 	return nullptr;
 	}
 
-IntrusivePtr<StringVal> NFS_Interp::nfs3_post_op_fh(const u_char*& buf, int& n)
+zeek::IntrusivePtr<StringVal> NFS_Interp::nfs3_post_op_fh(const u_char*& buf, int& n)
 	{
 	int have_fh = extract_XDR_uint32(buf, n);
 
@@ -507,7 +507,7 @@ IntrusivePtr<StringVal> NFS_Interp::nfs3_post_op_fh(const u_char*& buf, int& n)
 	return nullptr;
 	}
 
-IntrusivePtr<RecordVal> NFS_Interp::nfs3_pre_op_attr(const u_char*& buf, int& n)
+zeek::IntrusivePtr<RecordVal> NFS_Interp::nfs3_pre_op_attr(const u_char*& buf, int& n)
 	{
 	int have_attrs = extract_XDR_uint32(buf, n);
 
@@ -516,16 +516,16 @@ IntrusivePtr<RecordVal> NFS_Interp::nfs3_pre_op_attr(const u_char*& buf, int& n)
 	return nullptr;
 	}
 
-IntrusivePtr<EnumVal> NFS_Interp::nfs3_stable_how(const u_char*& buf, int& n)
+zeek::IntrusivePtr<EnumVal> NFS_Interp::nfs3_stable_how(const u_char*& buf, int& n)
 	{
 	BifEnum::NFS3::stable_how_t stable = (BifEnum::NFS3::stable_how_t)extract_XDR_uint32(buf, n);
 	auto rval = zeek::BifType::Enum::NFS3::stable_how_t->GetVal(stable);
 	return rval;
 	}
 
-IntrusivePtr<RecordVal> NFS_Interp::nfs3_lookup_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status)
+zeek::IntrusivePtr<RecordVal> NFS_Interp::nfs3_lookup_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status)
 	{
-	auto rep = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::lookup_reply_t);
+	auto rep = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::lookup_reply_t);
 
 	if ( status == BifEnum::NFS3::NFS3ERR_OK )
 		{
@@ -542,9 +542,9 @@ IntrusivePtr<RecordVal> NFS_Interp::nfs3_lookup_reply(const u_char*& buf, int& n
 	return rep;
 	}
 
-IntrusivePtr<RecordVal> NFS_Interp::nfs3_readargs(const u_char*& buf, int& n)
+zeek::IntrusivePtr<RecordVal> NFS_Interp::nfs3_readargs(const u_char*& buf, int& n)
 	{
-	auto readargs = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::readargs_t);
+	auto readargs = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::readargs_t);
 
 	readargs->Assign(0, nfs3_fh(buf, n));
 	readargs->Assign(1, ExtractUint64(buf, n));  // offset
@@ -553,10 +553,10 @@ IntrusivePtr<RecordVal> NFS_Interp::nfs3_readargs(const u_char*& buf, int& n)
 	return readargs;
 	}
 
-IntrusivePtr<RecordVal> NFS_Interp::nfs3_read_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status,
+zeek::IntrusivePtr<RecordVal> NFS_Interp::nfs3_read_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status,
 		bro_uint_t offset)
 	{
-	auto rep = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::read_reply_t);
+	auto rep = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::read_reply_t);
 
 	if (status == BifEnum::NFS3::NFS3ERR_OK)
 		{
@@ -576,9 +576,9 @@ IntrusivePtr<RecordVal> NFS_Interp::nfs3_read_reply(const u_char*& buf, int& n,
 	return rep;
 	}
 
-IntrusivePtr<RecordVal> NFS_Interp::nfs3_readlink_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status)
+zeek::IntrusivePtr<RecordVal> NFS_Interp::nfs3_readlink_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status)
 	{
-	auto rep = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::readlink_reply_t);
+	auto rep = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::readlink_reply_t);
 
 	if (status == BifEnum::NFS3::NFS3ERR_OK)
 		{
@@ -593,9 +593,9 @@ IntrusivePtr<RecordVal> NFS_Interp::nfs3_readlink_reply(const u_char*& buf, int&
 	return rep;
 	}
 
-IntrusivePtr<RecordVal> NFS_Interp::nfs3_link_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status)
+zeek::IntrusivePtr<RecordVal> NFS_Interp::nfs3_link_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status)
 	{
-	auto rep = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::link_reply_t);
+	auto rep = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::link_reply_t);
 
 	if ( status == BifEnum::NFS3::NFS3ERR_OK )
 		{
@@ -609,9 +609,9 @@ IntrusivePtr<RecordVal> NFS_Interp::nfs3_link_reply(const u_char*& buf, int& n,
 	return rep;
 	}
 
-IntrusivePtr<RecordVal> NFS_Interp::nfs3_symlinkargs(const u_char*& buf, int& n)
+zeek::IntrusivePtr<RecordVal> NFS_Interp::nfs3_symlinkargs(const u_char*& buf, int& n)
 	{
-	auto symlinkargs = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::symlinkargs_t);
+	auto symlinkargs = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::symlinkargs_t);
 
 	symlinkargs->Assign(0, nfs3_diropargs(buf, n));
 	symlinkargs->Assign(1, nfs3_symlinkdata(buf, n));
@@ -619,9 +619,9 @@ IntrusivePtr<RecordVal> NFS_Interp::nfs3_symlinkargs(const u_char*& buf, int& n)
 	return symlinkargs;
 	}
 
-IntrusivePtr<RecordVal> NFS_Interp::nfs3_sattrargs(const u_char*& buf, int& n)
+zeek::IntrusivePtr<RecordVal> NFS_Interp::nfs3_sattrargs(const u_char*& buf, int& n)
 	{
-	auto sattrargs = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::sattrargs_t);
+	auto sattrargs = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::sattrargs_t);
 
 	sattrargs->Assign(0, nfs3_fh(buf, n));
 	sattrargs->Assign(1, nfs3_sattr(buf, n));
@@ -629,9 +629,9 @@ IntrusivePtr<RecordVal> NFS_Interp::nfs3_sattrargs(const u_char*& buf, int& n)
 	return sattrargs;
 	}
 
-IntrusivePtr<RecordVal> NFS_Interp::nfs3_linkargs(const u_char*& buf, int& n)
+zeek::IntrusivePtr<RecordVal> NFS_Interp::nfs3_linkargs(const u_char*& buf, int& n)
 	{
-	auto linkargs = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::linkargs_t);
+	auto linkargs = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::linkargs_t);
 
 	linkargs->Assign(0, nfs3_fh(buf, n));
 	linkargs->Assign(1, nfs3_diropargs(buf, n));
@@ -639,11 +639,11 @@ IntrusivePtr<RecordVal> NFS_Interp::nfs3_linkargs(const u_char*& buf, int& n)
 	return linkargs;
 	}
 
-IntrusivePtr<RecordVal> NFS_Interp::nfs3_writeargs(const u_char*& buf, int& n)
+zeek::IntrusivePtr<RecordVal> NFS_Interp::nfs3_writeargs(const u_char*& buf, int& n)
 	{
 	uint32_t bytes;
 	uint64_t offset;
-	auto writeargs = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::writeargs_t);
+	auto writeargs = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::writeargs_t);
 
 	writeargs->Assign(0, nfs3_fh(buf, n));
 	offset = extract_XDR_uint64(buf, n);
@@ -657,9 +657,9 @@ IntrusivePtr<RecordVal> NFS_Interp::nfs3_writeargs(const u_char*& buf, int& n)
 	return writeargs;
 	}
 
-IntrusivePtr<RecordVal> NFS_Interp::nfs3_write_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status)
+zeek::IntrusivePtr<RecordVal> NFS_Interp::nfs3_write_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status)
 	{
-	auto rep = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::write_reply_t);
+	auto rep = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::write_reply_t);
 
 	if ( status == BifEnum::NFS3::NFS3ERR_OK )
 		{
@@ -682,9 +682,9 @@ IntrusivePtr<RecordVal> NFS_Interp::nfs3_write_reply(const u_char*& buf, int& n,
 	return rep;
 	}
 
-IntrusivePtr<RecordVal> NFS_Interp::nfs3_newobj_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status)
+zeek::IntrusivePtr<RecordVal> NFS_Interp::nfs3_newobj_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status)
 	{
-	auto rep = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::newobj_reply_t);
+	auto rep = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::newobj_reply_t);
 
 	if (status == BifEnum::NFS3::NFS3ERR_OK)
 		{
@@ -706,9 +706,9 @@ IntrusivePtr<RecordVal> NFS_Interp::nfs3_newobj_reply(const u_char*& buf, int& n
 	return rep;
 	}
 
-IntrusivePtr<RecordVal> NFS_Interp::nfs3_delobj_reply(const u_char*& buf, int& n)
+zeek::IntrusivePtr<RecordVal> NFS_Interp::nfs3_delobj_reply(const u_char*& buf, int& n)
 	{
-	auto rep = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::delobj_reply_t);
+	auto rep = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::delobj_reply_t);
 
 	// wcc_data
 	rep->Assign(0, nfs3_pre_op_attr(buf, n));
@@ -717,9 +717,9 @@ IntrusivePtr<RecordVal> NFS_Interp::nfs3_delobj_reply(const u_char*& buf, int& n
 	return rep;
 	}
 
-IntrusivePtr<RecordVal> NFS_Interp::nfs3_renameobj_reply(const u_char*& buf, int& n)
+zeek::IntrusivePtr<RecordVal> NFS_Interp::nfs3_renameobj_reply(const u_char*& buf, int& n)
 	{
-	auto rep = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::renameobj_reply_t);
+	auto rep = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::renameobj_reply_t);
 
 	// wcc_data
 	rep->Assign(0, nfs3_pre_op_attr(buf, n));
@@ -730,9 +730,9 @@ IntrusivePtr<RecordVal> NFS_Interp::nfs3_renameobj_reply(const u_char*& buf, int
 	return rep;
 	}
 
-IntrusivePtr<RecordVal> NFS_Interp::nfs3_readdirargs(bool isplus, const u_char*& buf, int&n)
+zeek::IntrusivePtr<RecordVal> NFS_Interp::nfs3_readdirargs(bool isplus, const u_char*& buf, int&n)
 	{
-	auto args = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::readdirargs_t);
+	auto args = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::readdirargs_t);
 
 	args->Assign(0, val_mgr->Bool(isplus));
 	args->Assign(1, nfs3_fh(buf, n));
@@ -746,17 +746,17 @@ IntrusivePtr<RecordVal> NFS_Interp::nfs3_readdirargs(bool isplus, const u_char*&
 	return args;
 	}
 
-IntrusivePtr<RecordVal> NFS_Interp::nfs3_readdir_reply(bool isplus, const u_char*& buf,
+zeek::IntrusivePtr<RecordVal> NFS_Interp::nfs3_readdir_reply(bool isplus, const u_char*& buf,
 		int&n, BifEnum::NFS3::status_t status)
 	{
-	auto rep = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::readdir_reply_t);
+	auto rep = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::readdir_reply_t);
 
 	rep->Assign(0, val_mgr->Bool(isplus));
 
 	if ( status == BifEnum::NFS3::NFS3ERR_OK )
 		{
 		unsigned pos;
-		auto entries = make_intrusive<VectorVal>(zeek::BifType::Vector::NFS3::direntry_vec_t);
+		auto entries = zeek::make_intrusive<VectorVal>(zeek::BifType::Vector::NFS3::direntry_vec_t);
 
 		rep->Assign(1, nfs3_post_op_attr(buf,n));   // dir_attr
 		rep->Assign(2, ExtractUint64(buf,n));  // cookieverf
@@ -765,7 +765,7 @@ IntrusivePtr<RecordVal> NFS_Interp::nfs3_readdir_reply(bool isplus, const u_char
 
 		while ( extract_XDR_uint32(buf,n) )
 			{
-			auto entry = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::direntry_t);
+			auto entry = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::direntry_t);
 			entry->Assign(0, ExtractUint64(buf,n)); // fileid
 			entry->Assign(1, nfs3_filename(buf,n)); // fname
 			entry->Assign(2, ExtractUint64(buf,n)); // cookie
@@ -791,27 +791,27 @@ IntrusivePtr<RecordVal> NFS_Interp::nfs3_readdir_reply(bool isplus, const u_char
 	return rep;
 	}
 
-IntrusivePtr<Val> NFS_Interp::ExtractUint32(const u_char*& buf, int& n)
+zeek::IntrusivePtr<Val> NFS_Interp::ExtractUint32(const u_char*& buf, int& n)
 	{
 	return val_mgr->Count(extract_XDR_uint32(buf, n));
 	}
 
-IntrusivePtr<Val> NFS_Interp::ExtractUint64(const u_char*& buf, int& n)
+zeek::IntrusivePtr<Val> NFS_Interp::ExtractUint64(const u_char*& buf, int& n)
 	{
 	return val_mgr->Count(extract_XDR_uint64(buf, n));
 	}
 
-IntrusivePtr<Val> NFS_Interp::ExtractTime(const u_char*& buf, int& n)
+zeek::IntrusivePtr<Val> NFS_Interp::ExtractTime(const u_char*& buf, int& n)
 	{
-	return make_intrusive<TimeVal>(extract_XDR_time(buf, n));
+	return zeek::make_intrusive<TimeVal>(extract_XDR_time(buf, n));
 	}
 
-IntrusivePtr<Val> NFS_Interp::ExtractInterval(const u_char*& buf, int& n)
+zeek::IntrusivePtr<Val> NFS_Interp::ExtractInterval(const u_char*& buf, int& n)
 	{
-	return make_intrusive<IntervalVal>(double(extract_XDR_uint32(buf, n)), 1.0);
+	return zeek::make_intrusive<IntervalVal>(double(extract_XDR_uint32(buf, n)), 1.0);
 	}
 
-IntrusivePtr<Val> NFS_Interp::ExtractBool(const u_char*& buf, int& n)
+zeek::IntrusivePtr<Val> NFS_Interp::ExtractBool(const u_char*& buf, int& n)
 	{
 	return val_mgr->Bool(extract_XDR_uint32(buf, n));
 	}
diff --git a/src/analyzer/protocol/rpc/NFS.h b/src/analyzer/protocol/rpc/NFS.h
index 9d5942878e..ea3c9d2ae3 100644
--- a/src/analyzer/protocol/rpc/NFS.h
+++ b/src/analyzer/protocol/rpc/NFS.h
@@ -30,53 +30,53 @@ protected:
 	// to 0. However, the methods might still return an allocated Val * !
 	// So, you might want to Unref() the Val if buf is 0. Method names
 	// are based on the type names of RFC 1813.
-	IntrusivePtr<StringVal> nfs3_fh(const u_char*& buf, int& n);
-	IntrusivePtr<RecordVal> nfs3_fattr(const u_char*& buf, int& n);
-	IntrusivePtr<RecordVal> nfs3_sattr(const u_char*& buf, int& n);
-	IntrusivePtr<EnumVal> nfs3_ftype(const u_char*& buf, int& n);
-	IntrusivePtr<EnumVal> nfs3_time_how(const u_char*& buf, int& n);
-	IntrusivePtr<RecordVal> nfs3_wcc_attr(const u_char*& buf, int& n);
-	IntrusivePtr<RecordVal> nfs3_diropargs(const u_char*&buf, int &n);
-	IntrusivePtr<RecordVal> nfs3_symlinkdata(const u_char*& buf, int& n);
-	IntrusivePtr<RecordVal> nfs3_renameopargs(const u_char*&buf, int &n);
-	IntrusivePtr<StringVal> nfs3_filename(const u_char*& buf, int& n);
-	IntrusivePtr<RecordVal> nfs3_linkargs(const u_char*& buf, int& n);
-	IntrusivePtr<RecordVal> nfs3_symlinkargs(const u_char*& buf, int& n);
-	IntrusivePtr<RecordVal> nfs3_sattrargs(const u_char*& buf, int& n);
-	IntrusivePtr<StringVal> nfs3_nfspath(const u_char*& buf, int& n)
+	zeek::IntrusivePtr<StringVal> nfs3_fh(const u_char*& buf, int& n);
+	zeek::IntrusivePtr<RecordVal> nfs3_fattr(const u_char*& buf, int& n);
+	zeek::IntrusivePtr<RecordVal> nfs3_sattr(const u_char*& buf, int& n);
+	zeek::IntrusivePtr<EnumVal> nfs3_ftype(const u_char*& buf, int& n);
+	zeek::IntrusivePtr<EnumVal> nfs3_time_how(const u_char*& buf, int& n);
+	zeek::IntrusivePtr<RecordVal> nfs3_wcc_attr(const u_char*& buf, int& n);
+	zeek::IntrusivePtr<RecordVal> nfs3_diropargs(const u_char*&buf, int &n);
+	zeek::IntrusivePtr<RecordVal> nfs3_symlinkdata(const u_char*& buf, int& n);
+	zeek::IntrusivePtr<RecordVal> nfs3_renameopargs(const u_char*&buf, int &n);
+	zeek::IntrusivePtr<StringVal> nfs3_filename(const u_char*& buf, int& n);
+	zeek::IntrusivePtr<RecordVal> nfs3_linkargs(const u_char*& buf, int& n);
+	zeek::IntrusivePtr<RecordVal> nfs3_symlinkargs(const u_char*& buf, int& n);
+	zeek::IntrusivePtr<RecordVal> nfs3_sattrargs(const u_char*& buf, int& n);
+	zeek::IntrusivePtr<StringVal> nfs3_nfspath(const u_char*& buf, int& n)
 		{
 		return nfs3_filename(buf,n);
 		}
 
-	IntrusivePtr<RecordVal> nfs3_post_op_attr(const u_char*&buf, int &n);	// Return 0 or an fattr
-	IntrusivePtr<RecordVal> nfs3_pre_op_attr(const u_char*&buf, int &n);	// Return 0 or an wcc_attr
-	IntrusivePtr<RecordVal> nfs3_sattr_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status);
-	IntrusivePtr<RecordVal> nfs3_lookup_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status);
-	IntrusivePtr<RecordVal> nfs3_readargs(const u_char*& buf, int& n);
-	IntrusivePtr<RecordVal> nfs3_read_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status, bro_uint_t offset);
-	IntrusivePtr<RecordVal> nfs3_readlink_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status);
-	IntrusivePtr<RecordVal> nfs3_link_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status);
-	IntrusivePtr<RecordVal> nfs3_writeargs(const u_char*& buf, int& n);
-	IntrusivePtr<EnumVal> nfs3_stable_how(const u_char*& buf, int& n);
-	IntrusivePtr<RecordVal> nfs3_write_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status);
-	IntrusivePtr<RecordVal> nfs3_newobj_reply(const u_char*& buf, int&n, BifEnum::NFS3::status_t status);
-	IntrusivePtr<RecordVal> nfs3_delobj_reply(const u_char*& buf, int& n);
-	IntrusivePtr<RecordVal> nfs3_renameobj_reply(const u_char*& buf, int& n);
-	IntrusivePtr<StringVal> nfs3_post_op_fh(const u_char*& buf, int& n);
-	IntrusivePtr<RecordVal> nfs3_readdirargs(bool isplus, const u_char*& buf, int&n);
-	IntrusivePtr<RecordVal> nfs3_readdir_reply(bool isplus, const u_char*& buf, int&n, BifEnum::NFS3::status_t status);
+	zeek::IntrusivePtr<RecordVal> nfs3_post_op_attr(const u_char*&buf, int &n);	// Return 0 or an fattr
+	zeek::IntrusivePtr<RecordVal> nfs3_pre_op_attr(const u_char*&buf, int &n);	// Return 0 or an wcc_attr
+	zeek::IntrusivePtr<RecordVal> nfs3_sattr_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status);
+	zeek::IntrusivePtr<RecordVal> nfs3_lookup_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status);
+	zeek::IntrusivePtr<RecordVal> nfs3_readargs(const u_char*& buf, int& n);
+	zeek::IntrusivePtr<RecordVal> nfs3_read_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status, bro_uint_t offset);
+	zeek::IntrusivePtr<RecordVal> nfs3_readlink_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status);
+	zeek::IntrusivePtr<RecordVal> nfs3_link_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status);
+	zeek::IntrusivePtr<RecordVal> nfs3_writeargs(const u_char*& buf, int& n);
+	zeek::IntrusivePtr<EnumVal> nfs3_stable_how(const u_char*& buf, int& n);
+	zeek::IntrusivePtr<RecordVal> nfs3_write_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status);
+	zeek::IntrusivePtr<RecordVal> nfs3_newobj_reply(const u_char*& buf, int&n, BifEnum::NFS3::status_t status);
+	zeek::IntrusivePtr<RecordVal> nfs3_delobj_reply(const u_char*& buf, int& n);
+	zeek::IntrusivePtr<RecordVal> nfs3_renameobj_reply(const u_char*& buf, int& n);
+	zeek::IntrusivePtr<StringVal> nfs3_post_op_fh(const u_char*& buf, int& n);
+	zeek::IntrusivePtr<RecordVal> nfs3_readdirargs(bool isplus, const u_char*& buf, int&n);
+	zeek::IntrusivePtr<RecordVal> nfs3_readdir_reply(bool isplus, const u_char*& buf, int&n, BifEnum::NFS3::status_t status);
 
 	// Consumes the file data in the RPC message. Depending on NFS::return_data* consts
 	// in bro.init returns NULL or the data as string val:
 	//   * offset is the offset of the read/write call
 	//   * size is the amount of bytes read (or requested to be written),
-	IntrusivePtr<StringVal> nfs3_file_data(const u_char*& buf, int& n, uint64_t offset, int size);
+	zeek::IntrusivePtr<StringVal> nfs3_file_data(const u_char*& buf, int& n, uint64_t offset, int size);
 
-	IntrusivePtr<Val> ExtractUint32(const u_char*& buf, int& n);
-	IntrusivePtr<Val> ExtractUint64(const u_char*& buf, int& n);
-	IntrusivePtr<Val> ExtractTime(const u_char*& buf, int& n);
-	IntrusivePtr<Val> ExtractInterval(const u_char*& buf, int& n);
-	IntrusivePtr<Val> ExtractBool(const u_char*& buf, int& n);
+	zeek::IntrusivePtr<Val> ExtractUint32(const u_char*& buf, int& n);
+	zeek::IntrusivePtr<Val> ExtractUint64(const u_char*& buf, int& n);
+	zeek::IntrusivePtr<Val> ExtractTime(const u_char*& buf, int& n);
+	zeek::IntrusivePtr<Val> ExtractInterval(const u_char*& buf, int& n);
+	zeek::IntrusivePtr<Val> ExtractBool(const u_char*& buf, int& n);
 };
 
 class NFS_Analyzer : public RPC_Analyzer {
diff --git a/src/analyzer/protocol/rpc/Portmap.cc b/src/analyzer/protocol/rpc/Portmap.cc
index e69bb9d487..5cb9b484b9 100644
--- a/src/analyzer/protocol/rpc/Portmap.cc
+++ b/src/analyzer/protocol/rpc/Portmap.cc
@@ -79,7 +79,7 @@ bool PortmapperInterp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status statu
 				     int reply_len)
 	{
 	EventHandlerPtr event;
-	IntrusivePtr<Val> reply;
+	zeek::IntrusivePtr<Val> reply;
 	int success = (status == BifEnum::RPC_SUCCESS);
 
 	switch ( c->Proc() ) {
@@ -139,7 +139,7 @@ bool PortmapperInterp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status statu
 		if ( success )
 			{
 			static auto pm_mappings = zeek::id::find_type<zeek::TableType>("pm_mappings");
-			auto mappings = make_intrusive<TableVal>(pm_mappings);
+			auto mappings = zeek::make_intrusive<TableVal>(pm_mappings);
 			uint32_t nmap = 0;
 
 			// Each call in the loop test pulls the next "opted"
@@ -189,10 +189,10 @@ bool PortmapperInterp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status statu
 	return true;
 	}
 
-IntrusivePtr<Val> PortmapperInterp::ExtractMapping(const u_char*& buf, int& len)
+zeek::IntrusivePtr<Val> PortmapperInterp::ExtractMapping(const u_char*& buf, int& len)
 	{
 	static auto pm_mapping = zeek::id::find_type<zeek::RecordType>("pm_mapping");
-	auto mapping = make_intrusive<RecordVal>(pm_mapping);
+	auto mapping = zeek::make_intrusive<RecordVal>(pm_mapping);
 
 	mapping->Assign(0, val_mgr->Count(extract_XDR_uint32(buf, len)));
 	mapping->Assign(1, val_mgr->Count(extract_XDR_uint32(buf, len)));
@@ -207,10 +207,10 @@ IntrusivePtr<Val> PortmapperInterp::ExtractMapping(const u_char*& buf, int& len)
 	return mapping;
 	}
 
-IntrusivePtr<Val> PortmapperInterp::ExtractPortRequest(const u_char*& buf, int& len)
+zeek::IntrusivePtr<Val> PortmapperInterp::ExtractPortRequest(const u_char*& buf, int& len)
 	{
 	static auto pm_port_request = zeek::id::find_type<zeek::RecordType>("pm_port_request");
-	auto pr = make_intrusive<RecordVal>(pm_port_request);
+	auto pr = zeek::make_intrusive<RecordVal>(pm_port_request);
 
 	pr->Assign(0, val_mgr->Count(extract_XDR_uint32(buf, len)));
 	pr->Assign(1, val_mgr->Count(extract_XDR_uint32(buf, len)));
@@ -225,10 +225,10 @@ IntrusivePtr<Val> PortmapperInterp::ExtractPortRequest(const u_char*& buf, int&
 	return pr;
 	}
 
-IntrusivePtr<Val> PortmapperInterp::ExtractCallItRequest(const u_char*& buf, int& len)
+zeek::IntrusivePtr<Val> PortmapperInterp::ExtractCallItRequest(const u_char*& buf, int& len)
 	{
 	static auto pm_callit_request = zeek::id::find_type<zeek::RecordType>("pm_callit_request");
-	auto c = make_intrusive<RecordVal>(pm_callit_request);
+	auto c = zeek::make_intrusive<RecordVal>(pm_callit_request);
 
 	c->Assign(0, val_mgr->Count(extract_XDR_uint32(buf, len)));
 	c->Assign(1, val_mgr->Count(extract_XDR_uint32(buf, len)));
@@ -262,7 +262,7 @@ uint32_t PortmapperInterp::CheckPort(uint32_t port)
 	return port;
 	}
 
-void PortmapperInterp::Event(EventHandlerPtr f, IntrusivePtr<Val> request, BifEnum::rpc_status status, IntrusivePtr<Val> reply)
+void PortmapperInterp::Event(EventHandlerPtr f, zeek::IntrusivePtr<Val> request, BifEnum::rpc_status status, zeek::IntrusivePtr<Val> reply)
 	{
 	if ( ! f )
 		return;
diff --git a/src/analyzer/protocol/rpc/Portmap.h b/src/analyzer/protocol/rpc/Portmap.h
index 9879976c28..428ec87af3 100644
--- a/src/analyzer/protocol/rpc/Portmap.h
+++ b/src/analyzer/protocol/rpc/Portmap.h
@@ -17,11 +17,11 @@ protected:
 			   double last_time, int reply_len) override;
 	uint32_t CheckPort(uint32_t port);
 
-	void Event(EventHandlerPtr f, IntrusivePtr<Val> request, BifEnum::rpc_status status, IntrusivePtr<Val> reply);
+	void Event(EventHandlerPtr f, zeek::IntrusivePtr<Val> request, BifEnum::rpc_status status, zeek::IntrusivePtr<Val> reply);
 
-	IntrusivePtr<Val> ExtractMapping(const u_char*& buf, int& len);
-	IntrusivePtr<Val> ExtractPortRequest(const u_char*& buf, int& len);
-	IntrusivePtr<Val> ExtractCallItRequest(const u_char*& buf, int& len);
+	zeek::IntrusivePtr<Val> ExtractMapping(const u_char*& buf, int& len);
+	zeek::IntrusivePtr<Val> ExtractPortRequest(const u_char*& buf, int& len);
+	zeek::IntrusivePtr<Val> ExtractCallItRequest(const u_char*& buf, int& len);
 };
 
 class Portmapper_Analyzer : public RPC_Analyzer {
diff --git a/src/analyzer/protocol/rpc/RPC.cc b/src/analyzer/protocol/rpc/RPC.cc
index a891266d25..8fa16b2f86 100644
--- a/src/analyzer/protocol/rpc/RPC.cc
+++ b/src/analyzer/protocol/rpc/RPC.cc
@@ -342,7 +342,7 @@ void RPC_Interpreter::Event_RPC_Dialogue(RPC_CallInfo* c, BifEnum::rpc_status st
 			val_mgr->Count(c->Version()),
 			val_mgr->Count(c->Proc()),
 			zeek::BifType::Enum::rpc_status->GetVal(status),
-			make_intrusive<TimeVal>(c->StartTime()),
+			zeek::make_intrusive<TimeVal>(c->StartTime()),
 			val_mgr->Count(c->CallLen()),
 			val_mgr->Count(reply_len)
 		);
diff --git a/src/analyzer/protocol/rpc/RPC.h b/src/analyzer/protocol/rpc/RPC.h
index 7d4a75bd8e..c7d1648a01 100644
--- a/src/analyzer/protocol/rpc/RPC.h
+++ b/src/analyzer/protocol/rpc/RPC.h
@@ -52,9 +52,9 @@ public:
 		     double last_time, int rpc_len);
 	~RPC_CallInfo();
 
-	void AddVal(IntrusivePtr<Val> arg_v)		{ v = std::move(arg_v); }
-	const IntrusivePtr<Val>& RequestVal() const		{ return v; }
-	IntrusivePtr<Val> TakeRequestVal()		{ auto rv = std::move(v); return rv; }
+	void AddVal(zeek::IntrusivePtr<Val> arg_v)		{ v = std::move(arg_v); }
+	const zeek::IntrusivePtr<Val>& RequestVal() const		{ return v; }
+	zeek::IntrusivePtr<Val> TakeRequestVal()		{ auto rv = std::move(v); return rv; }
 
 	bool CompareRexmit(const u_char* buf, int n) const;
 
@@ -95,7 +95,7 @@ protected:
 	int header_len;		// size of data before the arguments
 	bool valid_call;	// whether call was well-formed
 
-	IntrusivePtr<Val> v;		// single (perhaps compound) value corresponding to call
+	zeek::IntrusivePtr<Val> v;		// single (perhaps compound) value corresponding to call
 };
 
 class RPC_Interpreter {
diff --git a/src/analyzer/protocol/sip/sip-analyzer.pac b/src/analyzer/protocol/sip/sip-analyzer.pac
index 4a754dcd65..8f08ed2bc7 100644
--- a/src/analyzer/protocol/sip/sip-analyzer.pac
+++ b/src/analyzer/protocol/sip/sip-analyzer.pac
@@ -3,7 +3,7 @@ refine flow SIP_Flow += {
 	%member{
 		int content_length;
 		bool build_headers;
-		std::vector<IntrusivePtr<Val>> headers;
+		std::vector<zeek::IntrusivePtr<Val>> headers;
 	%}
 
 	%init{
@@ -59,7 +59,7 @@ refine flow SIP_Flow += {
 
 		if ( build_headers )
 			{
-			headers.push_back({AdoptRef{}, build_sip_header_val(name, value)});
+			headers.push_back({zeek::AdoptRef{}, build_sip_header_val(name, value)});
 			}
 
 		return true;
@@ -84,7 +84,7 @@ refine flow SIP_Flow += {
 		if ( sip_all_headers )
 			{
 			zeek::BifEvent::enqueue_sip_all_headers(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(),
-							   is_orig(), {AdoptRef{}, build_sip_headers_val()});
+							   is_orig(), {zeek::AdoptRef{}, build_sip_headers_val()});
 			}
 
 		headers.clear();
@@ -104,12 +104,12 @@ refine flow SIP_Flow += {
 		%{
 		static auto mime_header_rec = zeek::id::find_type<zeek::RecordType>("mime_header_rec");
 		RecordVal* header_record = new RecordVal(mime_header_rec);
-		IntrusivePtr<StringVal> name_val;
+		zeek::IntrusivePtr<StringVal> name_val;
 
 		if ( name.length() > 0 )
 			{
 			// Make it all uppercase.
-			name_val = make_intrusive<StringVal>(name.length(), (const char*) name.begin());
+			name_val = zeek::make_intrusive<StringVal>(name.length(), (const char*) name.begin());
 			name_val->ToUpper();
 			}
 		else
diff --git a/src/analyzer/protocol/smb/smb-strings.pac b/src/analyzer/protocol/smb/smb-strings.pac
index 2c7988b37c..42e9ab0416 100644
--- a/src/analyzer/protocol/smb/smb-strings.pac
+++ b/src/analyzer/protocol/smb/smb-strings.pac
@@ -3,7 +3,7 @@
 %}
 
 %code{
-IntrusivePtr<StringVal> binpac::SMB::SMB_Conn::uint8s_to_stringval(std::vector<uint8_t>* data)
+zeek::IntrusivePtr<StringVal> binpac::SMB::SMB_Conn::uint8s_to_stringval(std::vector<uint8_t>* data)
 	{
 	int length = data->size();
 	auto buf = std::make_unique<uint8[]>(length);
@@ -15,7 +15,7 @@ IntrusivePtr<StringVal> binpac::SMB::SMB_Conn::uint8s_to_stringval(std::vector<u
 	return utf16_to_utf8_val(bro_analyzer()->Conn(), bs);
 	}
 
-IntrusivePtr<StringVal> binpac::SMB::SMB_Conn::extract_string(SMB_string* s)
+zeek::IntrusivePtr<StringVal> binpac::SMB::SMB_Conn::extract_string(SMB_string* s)
 	{
 	if ( s->unicode() == false )
 		{
@@ -31,18 +31,18 @@ IntrusivePtr<StringVal> binpac::SMB::SMB_Conn::extract_string(SMB_string* s)
 		if ( length > 0 && buf[length-1] == 0x00 )
 			length--;
 
-		return make_intrusive<StringVal>(length, buf.get());
+		return zeek::make_intrusive<StringVal>(length, buf.get());
 		}
 	else
 		return uint8s_to_stringval(s->u()->s());
 	}
 
-IntrusivePtr<StringVal> binpac::SMB::SMB_Conn::smb_string2stringval(SMB_string* s)
+zeek::IntrusivePtr<StringVal> binpac::SMB::SMB_Conn::smb_string2stringval(SMB_string* s)
 	{
 	return extract_string(s);
 	}
 
-IntrusivePtr<StringVal> binpac::SMB::SMB_Conn::smb2_string2stringval(SMB2_string* s)
+zeek::IntrusivePtr<StringVal> binpac::SMB::SMB_Conn::smb2_string2stringval(SMB2_string* s)
 	{
 	return uint8s_to_stringval(s->s());
 	}
@@ -50,10 +50,10 @@ IntrusivePtr<StringVal> binpac::SMB::SMB_Conn::smb2_string2stringval(SMB2_string
 
 refine connection SMB_Conn += {
 	%member{
-		IntrusivePtr<StringVal> uint8s_to_stringval(std::vector<uint8_t>* data);
-		IntrusivePtr<StringVal> extract_string(SMB_string* s);
-		IntrusivePtr<StringVal> smb_string2stringval(SMB_string* s);
-		IntrusivePtr<StringVal> smb2_string2stringval(SMB2_string* s);
+		zeek::IntrusivePtr<StringVal> uint8s_to_stringval(std::vector<uint8_t>* data);
+		zeek::IntrusivePtr<StringVal> extract_string(SMB_string* s);
+		zeek::IntrusivePtr<StringVal> smb_string2stringval(SMB_string* s);
+		zeek::IntrusivePtr<StringVal> smb2_string2stringval(SMB2_string* s);
 
 		SMB_unicode_string* me;
 	%}
diff --git a/src/analyzer/protocol/smb/smb-time.pac b/src/analyzer/protocol/smb/smb-time.pac
index aa4d65bcb4..f8a36476bb 100644
--- a/src/analyzer/protocol/smb/smb-time.pac
+++ b/src/analyzer/protocol/smb/smb-time.pac
@@ -1,21 +1,21 @@
 %header{
-IntrusivePtr<Val> filetime2brotime(uint64_t ts);
-IntrusivePtr<Val> time_from_lanman(SMB_time* t, SMB_date* d, uint16_t tz);
+zeek::IntrusivePtr<Val> filetime2brotime(uint64_t ts);
+zeek::IntrusivePtr<Val> time_from_lanman(SMB_time* t, SMB_date* d, uint16_t tz);
 
-IntrusivePtr<RecordVal> SMB_BuildMACTimes(uint64_t modify, uint64_t access,
-                                          uint64_t create, uint64_t change);
+zeek::IntrusivePtr<RecordVal> SMB_BuildMACTimes(uint64_t modify, uint64_t access,
+                                                uint64_t create, uint64_t change);
 %}
 
 %code{
-IntrusivePtr<Val> filetime2brotime(uint64_t ts)
+zeek::IntrusivePtr<Val> filetime2brotime(uint64_t ts)
 	{
 	// Bro can't support times back to the 1600's
 	// so we subtract a lot of seconds.
 	double secs = (ts / 10000000.0L) - 11644473600.0L;
-	return make_intrusive<TimeVal>(secs);
+	return zeek::make_intrusive<TimeVal>(secs);
 	}
 
-IntrusivePtr<Val> time_from_lanman(SMB_time* t, SMB_date* d, uint16_t tz)
+zeek::IntrusivePtr<Val> time_from_lanman(SMB_time* t, SMB_date* d, uint16_t tz)
 	{
 	tm lTime;
 	lTime.tm_sec = ${t.two_seconds} * 2;
@@ -26,13 +26,13 @@ IntrusivePtr<Val> time_from_lanman(SMB_time* t, SMB_date* d, uint16_t tz)
 	lTime.tm_year = 1980 + ${d.year};
 	lTime.tm_isdst = -1;
 	double lResult = mktime(&lTime);
-	return make_intrusive<TimeVal>(lResult + tz);
+	return zeek::make_intrusive<TimeVal>(lResult + tz);
 	}
 
-IntrusivePtr<RecordVal> SMB_BuildMACTimes(uint64_t modify, uint64_t access,
-                                          uint64_t create, uint64_t change)
+zeek::IntrusivePtr<RecordVal> SMB_BuildMACTimes(uint64_t modify, uint64_t access,
+                                                uint64_t create, uint64_t change)
 	{
-	auto r = make_intrusive<RecordVal>(zeek::BifType::Record::SMB::MACTimes);
+	auto r = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB::MACTimes);
 	r->Assign(0, filetime2brotime(modify));
 	r->Assign(1, filetime2brotime(access));
 	r->Assign(2, filetime2brotime(create));
diff --git a/src/analyzer/protocol/smb/smb1-com-negotiate.pac b/src/analyzer/protocol/smb/smb1-com-negotiate.pac
index 1a6ef0c3bd..7328dece81 100644
--- a/src/analyzer/protocol/smb/smb1-com-negotiate.pac
+++ b/src/analyzer/protocol/smb/smb1-com-negotiate.pac
@@ -15,7 +15,7 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb1_negotiate_request )
 			{
-			auto dialects = make_intrusive<VectorVal>(zeek::id::string_vec);
+			auto dialects = zeek::make_intrusive<VectorVal>(zeek::id::string_vec);
 
 			for ( unsigned int i = 0; i < ${val.dialects}->size(); ++i )
 				{
@@ -35,13 +35,13 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb1_negotiate_response )
 			{
-			auto response = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::NegotiateResponse);
+			auto response = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::NegotiateResponse);
 
 			switch ( ${val.word_count} )
 				{
 				case 0x01:
 					{
-					auto core = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::NegotiateResponseCore);
+					auto core = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::NegotiateResponseCore);
 					core->Assign(0, val_mgr->Count(${val.dialect_index}));
 
 					response->Assign(0, std::move(core));
@@ -50,15 +50,15 @@ refine connection SMB_Conn += {
 
 				case 0x0d:
 					{
-					auto security = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::NegotiateResponseSecurity);
+					auto security = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::NegotiateResponseSecurity);
 					security->Assign(0, val_mgr->Bool(${val.lanman.security_user_level}));
 					security->Assign(1, val_mgr->Bool(${val.lanman.security_challenge_response}));
 
-					auto raw = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::NegotiateRawMode);
+					auto raw = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::NegotiateRawMode);
 					raw->Assign(0, val_mgr->Bool(${val.lanman.raw_read_supported}));
 					raw->Assign(1, val_mgr->Bool(${val.lanman.raw_write_supported}));
 
-					auto lanman = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::NegotiateResponseLANMAN);
+					auto lanman = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::NegotiateResponseLANMAN);
 					lanman->Assign(0, val_mgr->Count(${val.word_count}));
 					lanman->Assign(1, val_mgr->Count(${val.dialect_index}));
 					lanman->Assign(2, std::move(security));
@@ -79,13 +79,13 @@ refine connection SMB_Conn += {
 
 				case 0x11:
 					{
-					auto security = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::NegotiateResponseSecurity);
+					auto security = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::NegotiateResponseSecurity);
 					security->Assign(0, val_mgr->Bool(${val.ntlm.security_user_level}));
 					security->Assign(1, val_mgr->Bool(${val.ntlm.security_challenge_response}));
 					security->Assign(2, val_mgr->Bool(${val.ntlm.security_signatures_enabled}));
 					security->Assign(3, val_mgr->Bool(${val.ntlm.security_signatures_required}));
 
-					auto capabilities = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::NegotiateCapabilities);
+					auto capabilities = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::NegotiateCapabilities);
 					capabilities->Assign(0, val_mgr->Bool(${val.ntlm.capabilities_raw_mode}));
 					capabilities->Assign(1, val_mgr->Bool(${val.ntlm.capabilities_mpx_mode}));
 					capabilities->Assign(2, val_mgr->Bool(${val.ntlm.capabilities_unicode}));
@@ -108,7 +108,7 @@ refine connection SMB_Conn += {
 					capabilities->Assign(16, val_mgr->Bool(${val.ntlm.capabilities_compressed_data}));
 					capabilities->Assign(17, val_mgr->Bool(${val.ntlm.capabilities_extended_security}));
 
-					auto ntlm = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::NegotiateResponseNTLM);
+					auto ntlm = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::NegotiateResponseNTLM);
 					ntlm->Assign(0, val_mgr->Count(${val.word_count}));
 					ntlm->Assign(1, val_mgr->Count(${val.dialect_index}));
 					ntlm->Assign(2, std::move(security));
@@ -251,4 +251,3 @@ type SMB1_negotiate_ntlm_response(header: SMB_Header) = record {
 
 	gssapi_proc : bool = $context.connection.forward_gssapi(security_blob, false) &if(capabilities_extended_security);
 };
-
diff --git a/src/analyzer/protocol/smb/smb1-com-session-setup-andx.pac b/src/analyzer/protocol/smb/smb1-com-session-setup-andx.pac
index ddc2c6ce3e..f17902c35f 100644
--- a/src/analyzer/protocol/smb/smb1-com-session-setup-andx.pac
+++ b/src/analyzer/protocol/smb/smb1-com-session-setup-andx.pac
@@ -12,7 +12,7 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb1_session_setup_andx_request )
 			{
-			auto request = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::SessionSetupAndXRequest);
+			auto request = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::SessionSetupAndXRequest);
 
 			request->Assign(0, val_mgr->Count(${val.word_count}));
 			switch ( ${val.word_count} ) {
@@ -31,7 +31,7 @@ refine connection SMB_Conn += {
 					break;
 				case 12:	// NT LM 0.12 with extended security
 					{
-					auto capabilities = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::SessionSetupAndXCapabilities);
+					auto capabilities = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::SessionSetupAndXCapabilities);
 				 	capabilities->Assign(0, val_mgr->Bool(${val.ntlm_extended_security.capabilities.unicode}));
 				 	capabilities->Assign(1, val_mgr->Bool(${val.ntlm_extended_security.capabilities.large_files}));
 				 	capabilities->Assign(2, val_mgr->Bool(${val.ntlm_extended_security.capabilities.nt_smbs}));
@@ -53,7 +53,7 @@ refine connection SMB_Conn += {
 
 				case 13: // NT LM 0.12 without extended security
 					{
-					auto capabilities = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::SessionSetupAndXCapabilities);
+					auto capabilities = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::SessionSetupAndXCapabilities);
 				 	capabilities->Assign(0, val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.unicode}));
 				 	capabilities->Assign(1, val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.large_files}));
 				 	capabilities->Assign(2, val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.nt_smbs}));
@@ -90,7 +90,7 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb1_session_setup_andx_response )
 			{
-			auto response = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::SessionSetupAndXResponse);
+			auto response = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::SessionSetupAndXResponse);
 			response->Assign(0, val_mgr->Count(${val.word_count}));
 
 			switch ( ${val.word_count} )
diff --git a/src/analyzer/protocol/smb/smb1-com-transaction-secondary.pac b/src/analyzer/protocol/smb/smb1-com-transaction-secondary.pac
index 321e1f9183..e63c601064 100644
--- a/src/analyzer/protocol/smb/smb1-com-transaction-secondary.pac
+++ b/src/analyzer/protocol/smb/smb1-com-transaction-secondary.pac
@@ -5,7 +5,7 @@ refine connection SMB_Conn += {
 	if ( ! smb1_transaction_secondary_request )
 		return false;
 
-	auto args = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::Trans_Sec_Args);
+	auto args = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::Trans_Sec_Args);
 	args->Assign(0, val_mgr->Count(${val.total_param_count}));
 	args->Assign(1, val_mgr->Count(${val.total_data_count}));
 	args->Assign(2, val_mgr->Count(${val.param_count}));
@@ -15,9 +15,9 @@ refine connection SMB_Conn += {
 	args->Assign(6, val_mgr->Count(${val.data_offset}));
 	args->Assign(7, val_mgr->Count(${val.data_displacement}));
 
-	auto parameters = make_intrusive<StringVal>(${val.parameters}.length(),
+	auto parameters = zeek::make_intrusive<StringVal>(${val.parameters}.length(),
 	                                            (const char*)${val.parameters}.data());
-	IntrusivePtr<StringVal> payload_str;
+	zeek::IntrusivePtr<StringVal> payload_str;
 	SMB1_transaction_data* payload = nullptr;
 
 	if ( ${val.data_count} > 0 )
@@ -29,13 +29,13 @@ refine connection SMB_Conn += {
 		{
 		switch ( payload->trans_type() ) {
 		case SMB_PIPE:
-			payload_str = make_intrusive<StringVal>(${val.data_count}, (const char*)${val.data.pipe_data}.data());
+			payload_str = zeek::make_intrusive<StringVal>(${val.data_count}, (const char*)${val.data.pipe_data}.data());
 			break;
 		case SMB_UNKNOWN:
-			payload_str = make_intrusive<StringVal>(${val.data_count}, (const char*)${val.data.unknown}.data());
+			payload_str = zeek::make_intrusive<StringVal>(${val.data_count}, (const char*)${val.data.unknown}.data());
 			break;
 		default:
-			payload_str = make_intrusive<StringVal>(${val.data_count}, (const char*)${val.data.data}.data());
+			payload_str = zeek::make_intrusive<StringVal>(${val.data_count}, (const char*)${val.data.data}.data());
 			break;
 		}
 		}
diff --git a/src/analyzer/protocol/smb/smb1-com-transaction.pac b/src/analyzer/protocol/smb/smb1-com-transaction.pac
index 221f8c5549..ba61ffd9f9 100644
--- a/src/analyzer/protocol/smb/smb1-com-transaction.pac
+++ b/src/analyzer/protocol/smb/smb1-com-transaction.pac
@@ -5,7 +5,7 @@ enum Trans_subcommands {
 };
 
 %code{
-	IntrusivePtr<StringVal> SMB_Conn::transaction_data_to_val(SMB1_transaction_data* payload)
+	zeek::IntrusivePtr<StringVal> SMB_Conn::transaction_data_to_val(SMB1_transaction_data* payload)
 		{
 		switch ( payload->trans_type() ) {
 		case SMB_PIPE:
@@ -26,7 +26,7 @@ refine connection SMB_Conn += {
 	%member{
 		map<uint16, bool> is_file_a_pipe;
 
-		static IntrusivePtr<StringVal> transaction_data_to_val(SMB1_transaction_data* payload);
+		static zeek::IntrusivePtr<StringVal> transaction_data_to_val(SMB1_transaction_data* payload);
 	%}
 
 	function get_is_file_a_pipe(id: uint16): bool
@@ -53,9 +53,9 @@ refine connection SMB_Conn += {
 		if ( ! smb1_transaction_request )
 			return false;
 
-		auto parameters = make_intrusive<StringVal>(${val.parameters}.length(),
-		                                            (const char*)${val.parameters}.data());
-		IntrusivePtr<StringVal> payload_str;
+		auto parameters = zeek::make_intrusive<StringVal>(${val.parameters}.length(),
+		                                                  (const char*)${val.parameters}.data());
+		zeek::IntrusivePtr<StringVal> payload_str;
 
 		if ( ${val.data_count} > 0 )
 			payload_str = transaction_data_to_val(${val.data});
@@ -78,9 +78,9 @@ refine connection SMB_Conn += {
 		if ( ! smb1_transaction_response )
 			return false;
 
-		auto parameters = make_intrusive<StringVal>(${val.parameters}.length(),
-		                                            (const char*)${val.parameters}.data());
-		IntrusivePtr<StringVal> payload_str;
+		auto parameters = zeek::make_intrusive<StringVal>(${val.parameters}.length(),
+		                                                  (const char*)${val.parameters}.data());
+		zeek::IntrusivePtr<StringVal> payload_str;
 
 		if ( ${val.data_count} > 0 )
 			payload_str = transaction_data_to_val(${val.data[0]});
diff --git a/src/analyzer/protocol/smb/smb1-com-transaction2-secondary.pac b/src/analyzer/protocol/smb/smb1-com-transaction2-secondary.pac
index a3a65c8367..a8253767df 100644
--- a/src/analyzer/protocol/smb/smb1-com-transaction2-secondary.pac
+++ b/src/analyzer/protocol/smb/smb1-com-transaction2-secondary.pac
@@ -5,7 +5,7 @@ refine connection SMB_Conn += {
 	if ( ! smb1_transaction2_secondary_request )
 		return false;
 
-	auto args = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::Trans2_Sec_Args);
+	auto args = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::Trans2_Sec_Args);
 	args->Assign(0, val_mgr->Count(${val.total_param_count}));
 	args->Assign(1, val_mgr->Count(${val.total_data_count}));
 	args->Assign(2, val_mgr->Count(${val.param_count}));
@@ -16,8 +16,8 @@ refine connection SMB_Conn += {
 	args->Assign(7, val_mgr->Count(${val.data_displacement}));
 	args->Assign(8, val_mgr->Count(${val.FID}));
 
-	auto parameters = make_intrusive<StringVal>(${val.parameters}.length(), (const char*)${val.parameters}.data());
-	auto payload = make_intrusive<StringVal>(${val.data}.length(), (const char*)${val.data}.data());
+	auto parameters = zeek::make_intrusive<StringVal>(${val.parameters}.length(), (const char*)${val.parameters}.data());
+	auto payload = zeek::make_intrusive<StringVal>(${val.data}.length(), (const char*)${val.data}.data());
 
 	zeek::BifEvent::enqueue_smb1_transaction2_secondary_request(bro_analyzer(),
 	                                                      bro_analyzer()->Conn(),
diff --git a/src/analyzer/protocol/smb/smb1-com-transaction2.pac b/src/analyzer/protocol/smb/smb1-com-transaction2.pac
index b13865d989..a29b158b14 100644
--- a/src/analyzer/protocol/smb/smb1-com-transaction2.pac
+++ b/src/analyzer/protocol/smb/smb1-com-transaction2.pac
@@ -24,7 +24,7 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb1_transaction2_request )
 			{
-			auto args = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::Trans2_Args);
+			auto args = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::Trans2_Args);
 			args->Assign(0, val_mgr->Count(${val.total_param_count}));
 			args->Assign(1, val_mgr->Count(${val.total_data_count}));
 			args->Assign(2, val_mgr->Count(${val.max_param_count}));
@@ -131,7 +131,7 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb1_trans2_find_first2_request )
 			{
-			auto result = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::Find_First2_Request_Args);
+			auto result = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::Find_First2_Request_Args);
 			result->Assign(0, val_mgr->Count(${val.search_attrs}));
 			result->Assign(1, val_mgr->Count(${val.search_count}));
 			result->Assign(2, val_mgr->Count(${val.flags}));
diff --git a/src/analyzer/protocol/smb/smb1-protocol.pac b/src/analyzer/protocol/smb/smb1-protocol.pac
index 63e6d87e87..6f802f7742 100644
--- a/src/analyzer/protocol/smb/smb1-protocol.pac
+++ b/src/analyzer/protocol/smb/smb1-protocol.pac
@@ -3,13 +3,13 @@
 %}
 
 %header{
-	IntrusivePtr<RecordVal> SMBHeaderVal(SMB_Header* hdr);
+	zeek::IntrusivePtr<RecordVal> SMBHeaderVal(SMB_Header* hdr);
 %}
 
 %code{
-	IntrusivePtr<RecordVal> SMBHeaderVal(SMB_Header* hdr)
+	zeek::IntrusivePtr<RecordVal> SMBHeaderVal(SMB_Header* hdr)
 		{
-		auto r = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::Header);
+		auto r = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::Header);
 
 		//unsigned int status = 0;
 		//
diff --git a/src/analyzer/protocol/smb/smb2-com-close.pac b/src/analyzer/protocol/smb/smb2-com-close.pac
index db6b24b9b4..c7f7641e9c 100644
--- a/src/analyzer/protocol/smb/smb2-com-close.pac
+++ b/src/analyzer/protocol/smb/smb2-com-close.pac
@@ -20,7 +20,7 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb2_close_response )
 			{
-			auto resp = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::CloseResponse);
+			auto resp = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::CloseResponse);
 
 			resp->Assign(0, val_mgr->Count(${val.alloc_size}));
 			resp->Assign(1, val_mgr->Count(${val.eof}));
diff --git a/src/analyzer/protocol/smb/smb2-com-create.pac b/src/analyzer/protocol/smb/smb2-com-create.pac
index ac9feb22f0..dda0ce455e 100644
--- a/src/analyzer/protocol/smb/smb2-com-create.pac
+++ b/src/analyzer/protocol/smb/smb2-com-create.pac
@@ -16,7 +16,7 @@ refine connection SMB_Conn += {
 
 		if ( smb2_create_request )
 			{
-			auto requestinfo = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::CreateRequest);
+			auto requestinfo = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::CreateRequest);
 			requestinfo->Assign(0, std::move(filename));
 			requestinfo->Assign(1, val_mgr->Count(${val.disposition}));
 			requestinfo->Assign(2, val_mgr->Count(${val.create_options}));
@@ -33,7 +33,7 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb2_create_response )
 			{
-			auto responseinfo = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::CreateResponse);
+			auto responseinfo = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::CreateResponse);
 			responseinfo->Assign(0, BuildSMB2GUID(${val.file_id}));
 			responseinfo->Assign(1, val_mgr->Count(${val.eof}));
 			responseinfo->Assign(2, SMB_BuildMACTimes(${val.last_write_time},
diff --git a/src/analyzer/protocol/smb/smb2-com-negotiate.pac b/src/analyzer/protocol/smb/smb2-com-negotiate.pac
index cc639088f2..2f6931a1b6 100644
--- a/src/analyzer/protocol/smb/smb2-com-negotiate.pac
+++ b/src/analyzer/protocol/smb/smb2-com-negotiate.pac
@@ -22,7 +22,7 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb2_negotiate_request )
 			{
-			auto dialects = make_intrusive<VectorVal>(zeek::id::index_vec);
+			auto dialects = zeek::make_intrusive<VectorVal>(zeek::id::index_vec);
 
 			for ( unsigned int i = 0; i < ${val.dialects}->size(); ++i )
 				dialects->Assign(i, val_mgr->Count((*${val.dialects})[i]));
@@ -39,7 +39,7 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb2_negotiate_response )
 			{
-			auto nr = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::NegotiateResponse);
+			auto nr = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::NegotiateResponse);
 
 			nr->Assign(0, val_mgr->Count(${val.dialect_revision}));
 			nr->Assign(1, val_mgr->Count(${val.security_mode}));
@@ -48,7 +48,7 @@ refine connection SMB_Conn += {
 			nr->Assign(4, filetime2brotime(${val.server_start_time}));
 			nr->Assign(5, val_mgr->Count(${val.negotiate_context_count}));
 
-			auto cv = make_intrusive<VectorVal>(zeek::BifType::Vector::SMB2::NegotiateContextValues);
+			auto cv = zeek::make_intrusive<VectorVal>(zeek::BifType::Vector::SMB2::NegotiateContextValues);
 
 			if ( ${val.dialect_revision} == 0x0311 && ${val.negotiate_context_count} > 0 )
 				{
diff --git a/src/analyzer/protocol/smb/smb2-com-session-setup.pac b/src/analyzer/protocol/smb/smb2-com-session-setup.pac
index 5b4b5f27e8..566a11c39b 100644
--- a/src/analyzer/protocol/smb/smb2-com-session-setup.pac
+++ b/src/analyzer/protocol/smb/smb2-com-session-setup.pac
@@ -4,7 +4,7 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb2_session_setup_request )
 			{
-			auto req = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::SessionSetupRequest);
+			auto req = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::SessionSetupRequest);
 			req->Assign(0, val_mgr->Count(${val.security_mode}));
 
 			zeek::BifEvent::enqueue_smb2_session_setup_request(bro_analyzer(),
@@ -20,12 +20,12 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb2_session_setup_response )
 			{
-			auto flags = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::SessionSetupFlags);
+			auto flags = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::SessionSetupFlags);
 			flags->Assign(0, val_mgr->Bool(${val.flag_guest}));
 			flags->Assign(1, val_mgr->Bool(${val.flag_anonymous}));
 			flags->Assign(2, val_mgr->Bool(${val.flag_encrypt}));
 
-			auto resp = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::SessionSetupResponse);
+			auto resp = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::SessionSetupResponse);
 			resp->Assign(0, std::move(flags));
 
 			zeek::BifEvent::enqueue_smb2_session_setup_response(bro_analyzer(),
diff --git a/src/analyzer/protocol/smb/smb2-com-set-info.pac b/src/analyzer/protocol/smb/smb2-com-set-info.pac
index a1c13e61b6..d8fef7981e 100644
--- a/src/analyzer/protocol/smb/smb2-com-set-info.pac
+++ b/src/analyzer/protocol/smb/smb2-com-set-info.pac
@@ -93,11 +93,11 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb2_file_fullea )
 			{
-			auto eas = make_intrusive<VectorVal>(zeek::BifType::Vector::SMB2::FileEAs);
+			auto eas = zeek::make_intrusive<VectorVal>(zeek::BifType::Vector::SMB2::FileEAs);
 
 			for ( auto i = 0u; i < ${val.ea_vector}->size(); ++i )
 				{
-				auto r = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::FileEA);
+				auto r = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::FileEA);
 				r->Assign(0, smb2_string2stringval(${val.ea_vector[i].ea_name}));
 				r->Assign(1, smb2_string2stringval(${val.ea_vector[i].ea_value}));
 
@@ -192,7 +192,7 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb2_file_fscontrol )
 			{
-			auto r = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::Fscontrol);
+			auto r = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::Fscontrol);
 			r->Assign(0, val_mgr->Int(${val.free_space_start_filtering}));
 			r->Assign(1, val_mgr->Int(${val.free_space_start_threshold}));
 			r->Assign(2, val_mgr->Int(${val.free_space_stop_filtering}));
@@ -268,7 +268,7 @@ type SMB2_file_fullea_info_element = record {
 	flags             : uint8;
 	ea_name_length    : uint8;
 	ea_value_length   : uint16;
-	ea_name           : SMB2_string(ea_name_length); 
+	ea_name           : SMB2_string(ea_name_length);
 	ea_value          : SMB2_string(ea_value_length);
 	pad_to_next       : padding to next_entry_offset;
 } &let {
@@ -276,7 +276,7 @@ type SMB2_file_fullea_info_element = record {
 };
 
 type SMB2_file_fullea_info(sir: SMB2_set_info_request) = record {
-	ea_vector : SMB2_file_fullea_info_element[] &until($element.next_offset == 0);  
+	ea_vector : SMB2_file_fullea_info_element[] &until($element.next_offset == 0);
 } &let {
 	proc: bool = $context.connection.proc_smb2_set_info_request_file_fullea(this);
 };
diff --git a/src/analyzer/protocol/smb/smb2-com-transform-header.pac b/src/analyzer/protocol/smb/smb2-com-transform-header.pac
index a261f58d42..645ecc3d63 100644
--- a/src/analyzer/protocol/smb/smb2-com-transform-header.pac
+++ b/src/analyzer/protocol/smb/smb2-com-transform-header.pac
@@ -4,7 +4,7 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb2_transform_header )
 			{
-			auto r = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::Transform_header);
+			auto r = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::Transform_header);
 			r->Assign(0, to_stringval(${hdr.signature}));
 			r->Assign(1, to_stringval(${hdr.nonce}));
 			r->Assign(2, val_mgr->Count(${hdr.orig_msg_size}));
diff --git a/src/analyzer/protocol/smb/smb2-com-tree-connect.pac b/src/analyzer/protocol/smb/smb2-com-tree-connect.pac
index 63de3c1ccb..5028c41d31 100644
--- a/src/analyzer/protocol/smb/smb2-com-tree-connect.pac
+++ b/src/analyzer/protocol/smb/smb2-com-tree-connect.pac
@@ -18,7 +18,7 @@ refine connection SMB_Conn += {
 
 		if ( smb2_tree_connect_response )
 			{
-			auto resp = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::TreeConnectResponse);
+			auto resp = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::TreeConnectResponse);
 			resp->Assign(0, val_mgr->Count(${val.share_type}));
 
 			zeek::BifEvent::enqueue_smb2_tree_connect_response(bro_analyzer(),
@@ -54,4 +54,3 @@ type SMB2_tree_connect_response(header: SMB2_Header) = record {
 } &let {
 	proc: bool = $context.connection.proc_smb2_tree_connect_response(header, this);
 };
-
diff --git a/src/analyzer/protocol/smb/smb2-protocol.pac b/src/analyzer/protocol/smb/smb2-protocol.pac
index 3df04b354d..368a3f46f7 100644
--- a/src/analyzer/protocol/smb/smb2-protocol.pac
+++ b/src/analyzer/protocol/smb/smb2-protocol.pac
@@ -2,16 +2,16 @@
 #     http://msdn.microsoft.com/en-us/library/cc246497(v=PROT.13).aspx
 
 %header{
-IntrusivePtr<RecordVal> BuildSMB2HeaderVal(SMB2_Header* hdr);
-IntrusivePtr<RecordVal> BuildSMB2GUID(SMB2_guid* file_id);
-IntrusivePtr<RecordVal> smb2_file_attrs_to_bro(SMB2_file_attributes* val);
-IntrusivePtr<RecordVal> BuildSMB2ContextVal(SMB3_negotiate_context_value* ncv);
+zeek::IntrusivePtr<RecordVal> BuildSMB2HeaderVal(SMB2_Header* hdr);
+zeek::IntrusivePtr<RecordVal> BuildSMB2GUID(SMB2_guid* file_id);
+zeek::IntrusivePtr<RecordVal> smb2_file_attrs_to_bro(SMB2_file_attributes* val);
+zeek::IntrusivePtr<RecordVal> BuildSMB2ContextVal(SMB3_negotiate_context_value* ncv);
 %}
 
 %code{
-IntrusivePtr<RecordVal> BuildSMB2HeaderVal(SMB2_Header* hdr)
+zeek::IntrusivePtr<RecordVal> BuildSMB2HeaderVal(SMB2_Header* hdr)
 	{
-	auto r = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::Header);
+	auto r = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::Header);
 	r->Assign(0, val_mgr->Count(${hdr.credit_charge}));
 	r->Assign(1, val_mgr->Count(${hdr.status}));
 	r->Assign(2, val_mgr->Count(${hdr.command}));
@@ -25,17 +25,17 @@ IntrusivePtr<RecordVal> BuildSMB2HeaderVal(SMB2_Header* hdr)
 	return r;
 	}
 
-IntrusivePtr<RecordVal> BuildSMB2GUID(SMB2_guid* file_id)
+zeek::IntrusivePtr<RecordVal> BuildSMB2GUID(SMB2_guid* file_id)
 	{
-	auto r = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::GUID);
+	auto r = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::GUID);
 	r->Assign(0, val_mgr->Count(${file_id.persistent}));
 	r->Assign(1, val_mgr->Count(${file_id._volatile}));
 	return r;
 	}
 
-IntrusivePtr<RecordVal> smb2_file_attrs_to_bro(SMB2_file_attributes* val)
+zeek::IntrusivePtr<RecordVal> smb2_file_attrs_to_bro(SMB2_file_attributes* val)
 	{
-	auto r = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::FileAttrs);
+	auto r = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::FileAttrs);
 	r->Assign(0, val_mgr->Bool(${val.read_only}));
 	r->Assign(1, val_mgr->Bool(${val.hidden}));
 	r->Assign(2, val_mgr->Bool(${val.system}));
@@ -54,9 +54,9 @@ IntrusivePtr<RecordVal> smb2_file_attrs_to_bro(SMB2_file_attributes* val)
 	return r;
 	}
 
-IntrusivePtr<RecordVal> BuildSMB2ContextVal(SMB3_negotiate_context_value* ncv)
+zeek::IntrusivePtr<RecordVal> BuildSMB2ContextVal(SMB3_negotiate_context_value* ncv)
 	{
-	auto r = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::NegotiateContextValue);
+	auto r = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::NegotiateContextValue);
 
 	r->Assign(0, val_mgr->Count(${ncv.context_type}));
 	r->Assign(1, val_mgr->Count(${ncv.data_length}));
@@ -64,11 +64,11 @@ IntrusivePtr<RecordVal> BuildSMB2ContextVal(SMB3_negotiate_context_value* ncv)
 	switch ( ${ncv.context_type} ) {
 	case SMB2_PREAUTH_INTEGRITY_CAPABILITIES:
 		{
-		auto rpreauth = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::PreAuthIntegrityCapabilities);
+		auto rpreauth = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::PreAuthIntegrityCapabilities);
 		rpreauth->Assign(0, val_mgr->Count(${ncv.preauth_integrity_capabilities.hash_alg_count}));
 		rpreauth->Assign(1, val_mgr->Count(${ncv.preauth_integrity_capabilities.salt_length}));
 
-		auto ha = make_intrusive<VectorVal>(zeek::id::index_vec);
+		auto ha = zeek::make_intrusive<VectorVal>(zeek::id::index_vec);
 
 		for ( int i = 0; i < ${ncv.preauth_integrity_capabilities.hash_alg_count}; ++i )
 			{
@@ -84,10 +84,10 @@ IntrusivePtr<RecordVal> BuildSMB2ContextVal(SMB3_negotiate_context_value* ncv)
 
 	case SMB2_ENCRYPTION_CAPABILITIES:
 		{
-		auto rencr = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::EncryptionCapabilities);
+		auto rencr = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::EncryptionCapabilities);
 		rencr->Assign(0, val_mgr->Count(${ncv.encryption_capabilities.cipher_count}));
 
-		auto c = make_intrusive<VectorVal>(zeek::id::index_vec);
+		auto c = zeek::make_intrusive<VectorVal>(zeek::id::index_vec);
 
 		for ( int i = 0; i < ${ncv.encryption_capabilities.cipher_count}; ++i )
 			{
@@ -102,10 +102,10 @@ IntrusivePtr<RecordVal> BuildSMB2ContextVal(SMB3_negotiate_context_value* ncv)
 
 	case SMB2_COMPRESSION_CAPABILITIES:
 		{
-		auto rcomp = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::CompressionCapabilities);
+		auto rcomp = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::CompressionCapabilities);
 		rcomp->Assign(0, val_mgr->Count(${ncv.compression_capabilities.alg_count}));
 
-		auto c = make_intrusive<VectorVal>(zeek::id::index_vec);
+		auto c = zeek::make_intrusive<VectorVal>(zeek::id::index_vec);
 
 		for ( int i = 0; i < ${ncv.compression_capabilities.alg_count}; ++i )
 			{
diff --git a/src/analyzer/protocol/smtp/SMTP.cc b/src/analyzer/protocol/smtp/SMTP.cc
index d3933f91c6..013b173bc2 100644
--- a/src/analyzer/protocol/smtp/SMTP.cc
+++ b/src/analyzer/protocol/smtp/SMTP.cc
@@ -222,7 +222,7 @@ void SMTP_Analyzer::ProcessLine(int length, const char* line, bool orig)
 				EnqueueConnEvent(smtp_data,
 					ConnVal(),
 					val_mgr->Bool(orig),
-					make_intrusive<StringVal>(data_len, line)
+					zeek::make_intrusive<StringVal>(data_len, line)
 				);
 				}
 			}
@@ -353,8 +353,8 @@ void SMTP_Analyzer::ProcessLine(int length, const char* line, bool orig)
 					ConnVal(),
 					val_mgr->Bool(orig),
 					val_mgr->Count(reply_code),
-					make_intrusive<StringVal>(cmd),
-					make_intrusive<StringVal>(end_of_line - line, line),
+					zeek::make_intrusive<StringVal>(cmd),
+					zeek::make_intrusive<StringVal>(end_of_line - line, line),
 					val_mgr->Bool((pending_reply > 0))
 				);
 				}
@@ -855,14 +855,14 @@ void SMTP_Analyzer::RequestEvent(int cmd_len, const char* cmd,
 
 	if ( smtp_request )
 		{
-		auto cmd_arg = make_intrusive<StringVal>(cmd_len, cmd);
+		auto cmd_arg = zeek::make_intrusive<StringVal>(cmd_len, cmd);
 		cmd_arg->ToUpper();
 
 		EnqueueConnEvent(smtp_request,
 			ConnVal(),
 			val_mgr->Bool(orig_is_sender),
 			std::move(cmd_arg),
-			make_intrusive<StringVal>(arg_len, arg)
+			zeek::make_intrusive<StringVal>(arg_len, arg)
 		);
 		}
 	}
@@ -882,8 +882,8 @@ void SMTP_Analyzer::Unexpected(bool is_sender, const char* msg,
 		EnqueueConnEvent(smtp_unexpected,
 			ConnVal(),
 			val_mgr->Bool(is_orig),
-			make_intrusive<StringVal>(msg),
-			make_intrusive<StringVal>(detail_len, detail)
+			zeek::make_intrusive<StringVal>(msg),
+			zeek::make_intrusive<StringVal>(detail_len, detail)
 		);
 		}
 	}
diff --git a/src/analyzer/protocol/snmp/snmp-analyzer.pac b/src/analyzer/protocol/snmp/snmp-analyzer.pac
index 3b4af47cf5..8ab454088b 100644
--- a/src/analyzer/protocol/snmp/snmp-analyzer.pac
+++ b/src/analyzer/protocol/snmp/snmp-analyzer.pac
@@ -8,26 +8,26 @@
 %}
 
 %header{
-IntrusivePtr<AddrVal> network_address_to_val(const ASN1Encoding* na);
-IntrusivePtr<AddrVal> network_address_to_val(const NetworkAddress* na);
-IntrusivePtr<Val>     asn1_obj_to_val(const ASN1Encoding* obj);
+zeek::IntrusivePtr<AddrVal> network_address_to_val(const ASN1Encoding* na);
+zeek::IntrusivePtr<AddrVal> network_address_to_val(const NetworkAddress* na);
+zeek::IntrusivePtr<Val>     asn1_obj_to_val(const ASN1Encoding* obj);
 
-IntrusivePtr<RecordVal> build_hdr(const Header* header);
-IntrusivePtr<RecordVal> build_hdrV3(const Header* header);
-IntrusivePtr<VectorVal> build_bindings(const VarBindList* vbl);
-IntrusivePtr<RecordVal> build_pdu(const CommonPDU* pdu);
-IntrusivePtr<RecordVal> build_trap_pdu(const TrapPDU* pdu);
-IntrusivePtr<RecordVal> build_bulk_pdu(const GetBulkRequestPDU* pdu);
+zeek::IntrusivePtr<RecordVal> build_hdr(const Header* header);
+zeek::IntrusivePtr<RecordVal> build_hdrV3(const Header* header);
+zeek::IntrusivePtr<VectorVal> build_bindings(const VarBindList* vbl);
+zeek::IntrusivePtr<RecordVal> build_pdu(const CommonPDU* pdu);
+zeek::IntrusivePtr<RecordVal> build_trap_pdu(const TrapPDU* pdu);
+zeek::IntrusivePtr<RecordVal> build_bulk_pdu(const GetBulkRequestPDU* pdu);
 %}
 
 %code{
 
-IntrusivePtr<AddrVal> network_address_to_val(const NetworkAddress* na)
+zeek::IntrusivePtr<AddrVal> network_address_to_val(const NetworkAddress* na)
 	{
 	return network_address_to_val(na->encoding());
 	}
 
-IntrusivePtr<AddrVal> network_address_to_val(const ASN1Encoding* na)
+zeek::IntrusivePtr<AddrVal> network_address_to_val(const ASN1Encoding* na)
 	{
 	bytestring const& bs = na->content();
 
@@ -35,16 +35,16 @@ IntrusivePtr<AddrVal> network_address_to_val(const ASN1Encoding* na)
 	// but standards don't seem to currently make any provisions for IPv6,
 	// so ignore anything that can't be IPv4.
 	if ( bs.length() != 4 )
-		return make_intrusive<AddrVal>(IPAddr());
+		return zeek::make_intrusive<AddrVal>(IPAddr());
 
 	const u_char* data = reinterpret_cast<const u_char*>(bs.data());
 	uint32 network_order = extract_uint32(data);
-	return make_intrusive<AddrVal>(ntohl(network_order));
+	return zeek::make_intrusive<AddrVal>(ntohl(network_order));
 	}
 
-IntrusivePtr<Val> asn1_obj_to_val(const ASN1Encoding* obj)
+zeek::IntrusivePtr<Val> asn1_obj_to_val(const ASN1Encoding* obj)
 	{
-	IntrusivePtr<RecordVal> rval = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::ObjectValue);
+	zeek::IntrusivePtr<RecordVal> rval = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::ObjectValue);
 	uint8 tag = obj->meta()->tag();
 
 	rval->Assign(0, val_mgr->Count(tag));
@@ -85,20 +85,20 @@ IntrusivePtr<Val> asn1_obj_to_val(const ASN1Encoding* obj)
 	return rval;
 	}
 
-IntrusivePtr<Val> time_ticks_to_val(const TimeTicks* tt)
+zeek::IntrusivePtr<Val> time_ticks_to_val(const TimeTicks* tt)
 	{
 	return asn1_integer_to_val(tt->asn1_integer(), zeek::TYPE_COUNT);
 	}
 
-IntrusivePtr<RecordVal> build_hdr(const Header* header)
+zeek::IntrusivePtr<RecordVal> build_hdr(const Header* header)
 	{
-	auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::Header);
+	auto rv = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::Header);
 	rv->Assign(0, val_mgr->Count(header->version()));
 
 	switch ( header->version() ) {
 	case SNMPV1_TAG:
 		{
-		auto v1 = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::HeaderV1);
+		auto v1 = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::HeaderV1);
 		v1->Assign(0, asn1_octet_string_to_val(header->v1()->community()));
 		rv->Assign(1, std::move(v1));
 		}
@@ -106,7 +106,7 @@ IntrusivePtr<RecordVal> build_hdr(const Header* header)
 
 	case SNMPV2_TAG:
 		{
-		auto v2 = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::HeaderV2);
+		auto v2 = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::HeaderV2);
 		v2->Assign(0, asn1_octet_string_to_val(header->v2()->community()));
 		rv->Assign(2, std::move(v2));
 		}
@@ -122,9 +122,9 @@ IntrusivePtr<RecordVal> build_hdr(const Header* header)
 	return rv;
 	}
 
-IntrusivePtr<RecordVal> build_hdrV3(const Header* header)
+zeek::IntrusivePtr<RecordVal> build_hdrV3(const Header* header)
 	{
-	auto v3 = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::HeaderV3);
+	auto v3 = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::HeaderV3);
 	const v3Header* v3hdr = header->v3();
 	const v3HeaderData* global_data = v3hdr->global_data();
 	bytestring const& flags = global_data->flags()->encoding()->content();
@@ -142,7 +142,7 @@ IntrusivePtr<RecordVal> build_hdrV3(const Header* header)
 	if ( v3hdr->next()->tag() == ASN1_SEQUENCE_TAG )
 		{
 		const v3ScopedPDU* spdu = v3hdr->plaintext_pdu();
-		auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::ScopedPDU_Context);
+		auto rv = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::ScopedPDU_Context);
 		rv->Assign(0, asn1_octet_string_to_val(spdu->context_engine_id()));
 		rv->Assign(1, asn1_octet_string_to_val(spdu->context_name()));
 		v3->Assign(8, std::move(rv));
@@ -151,14 +151,14 @@ IntrusivePtr<RecordVal> build_hdrV3(const Header* header)
 	return v3;
 	}
 
-IntrusivePtr<VectorVal> build_bindings(const VarBindList* vbl)
+zeek::IntrusivePtr<VectorVal> build_bindings(const VarBindList* vbl)
 	{
-	auto vv = make_intrusive<VectorVal>(zeek::BifType::Vector::SNMP::Bindings);
+	auto vv = zeek::make_intrusive<VectorVal>(zeek::BifType::Vector::SNMP::Bindings);
 
 	for ( size_t i = 0; i < vbl->bindings()->size(); ++i )
 		{
 		VarBind* vb = (*vbl->bindings())[i];
-		auto binding = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::Binding);
+		auto binding = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::Binding);
 		binding->Assign(0, asn1_oid_to_val(vb->name()->oid()));
 		binding->Assign(1, asn1_obj_to_val(vb->value()->encoding()));
 		vv->Assign(i, std::move(binding));
@@ -167,9 +167,9 @@ IntrusivePtr<VectorVal> build_bindings(const VarBindList* vbl)
 	return vv;
 	}
 
-IntrusivePtr<RecordVal> build_pdu(const CommonPDU* pdu)
+zeek::IntrusivePtr<RecordVal> build_pdu(const CommonPDU* pdu)
 	{
-	auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::PDU);
+	auto rv = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::PDU);
 	rv->Assign(0, asn1_integer_to_val(pdu->request_id(), zeek::TYPE_INT));
 	rv->Assign(1, asn1_integer_to_val(pdu->error_status(), zeek::TYPE_INT));
 	rv->Assign(2, asn1_integer_to_val(pdu->error_index(), zeek::TYPE_INT));
@@ -177,9 +177,9 @@ IntrusivePtr<RecordVal> build_pdu(const CommonPDU* pdu)
 	return rv;
 	}
 
-IntrusivePtr<RecordVal> build_trap_pdu(const TrapPDU* pdu)
+zeek::IntrusivePtr<RecordVal> build_trap_pdu(const TrapPDU* pdu)
 	{
-	auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::TrapPDU);
+	auto rv = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::TrapPDU);
 	rv->Assign(0, asn1_oid_to_val(pdu->enterprise()));
 	rv->Assign(1, network_address_to_val(pdu->agent_addr()));
 	rv->Assign(2, asn1_integer_to_val(pdu->generic_trap(), zeek::TYPE_INT));
@@ -189,9 +189,9 @@ IntrusivePtr<RecordVal> build_trap_pdu(const TrapPDU* pdu)
 	return rv;
 	}
 
-IntrusivePtr<RecordVal> build_bulk_pdu(const GetBulkRequestPDU* pdu)
+zeek::IntrusivePtr<RecordVal> build_bulk_pdu(const GetBulkRequestPDU* pdu)
 	{
-	auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::BulkPDU);
+	auto rv = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::BulkPDU);
 	rv->Assign(0, asn1_integer_to_val(pdu->request_id(), zeek::TYPE_INT));
 	rv->Assign(1, asn1_integer_to_val(pdu->non_repeaters(), zeek::TYPE_COUNT));
 	rv->Assign(2, asn1_integer_to_val(pdu->max_repititions(), zeek::TYPE_COUNT));
diff --git a/src/analyzer/protocol/socks/socks-analyzer.pac b/src/analyzer/protocol/socks/socks-analyzer.pac
index 7c7932fb02..6aa9da8aac 100644
--- a/src/analyzer/protocol/socks/socks-analyzer.pac
+++ b/src/analyzer/protocol/socks/socks-analyzer.pac
@@ -1,10 +1,10 @@
 
 %header{
-IntrusivePtr<StringVal> array_to_string(vector<uint8> *a);
+zeek::IntrusivePtr<StringVal> array_to_string(vector<uint8> *a);
 %}
 
 %code{
-IntrusivePtr<StringVal> array_to_string(vector<uint8> *a)
+zeek::IntrusivePtr<StringVal> array_to_string(vector<uint8> *a)
 	{
 	int len = a->size();
 	auto tmp = std::make_unique<char[]>(len);
@@ -14,7 +14,7 @@ IntrusivePtr<StringVal> array_to_string(vector<uint8> *a)
 	while ( len > 0 && tmp[len-1] == '\0' )
 		--len;
 
-	return make_intrusive<StringVal>(len, tmp.get());
+	return zeek::make_intrusive<StringVal>(len, tmp.get());
 	}
 %}
 
@@ -25,8 +25,8 @@ refine connection SOCKS_Conn += {
 		if ( socks_request )
 			{
 			static auto socks_address = zeek::id::find_type<zeek::RecordType>("SOCKS::Address");
-			auto sa = make_intrusive<RecordVal>(socks_address);
-			sa->Assign(0, make_intrusive<AddrVal>(htonl(${request.addr})));
+			auto sa = zeek::make_intrusive<RecordVal>(socks_address);
+			sa->Assign(0, zeek::make_intrusive<AddrVal>(htonl(${request.addr})));
 
 			if ( ${request.v4a} )
 				sa->Assign(1, array_to_string(${request.name}));
@@ -50,8 +50,8 @@ refine connection SOCKS_Conn += {
 		if ( socks_reply )
 			{
 			static auto socks_address = zeek::id::find_type<zeek::RecordType>("SOCKS::Address");
-			auto sa = make_intrusive<RecordVal>(socks_address);
-			sa->Assign(0, make_intrusive<AddrVal>(htonl(${reply.addr})));
+			auto sa = zeek::make_intrusive<RecordVal>(socks_address);
+			sa->Assign(0, zeek::make_intrusive<AddrVal>(htonl(${reply.addr})));
 
 			zeek::BifEvent::enqueue_socks_reply(bro_analyzer(),
 			                              bro_analyzer()->Conn(),
@@ -83,22 +83,22 @@ refine connection SOCKS_Conn += {
 			}
 
 		static auto socks_address = zeek::id::find_type<zeek::RecordType>("SOCKS::Address");
-		auto sa = make_intrusive<RecordVal>(socks_address);
+		auto sa = zeek::make_intrusive<RecordVal>(socks_address);
 
 		// This is dumb and there must be a better way (checking for presence of a field)...
 		switch ( ${request.remote_name.addr_type} )
 			{
 			case 1:
-				sa->Assign(0, make_intrusive<AddrVal>(htonl(${request.remote_name.ipv4})));
+				sa->Assign(0, zeek::make_intrusive<AddrVal>(htonl(${request.remote_name.ipv4})));
 				break;
 
 			case 3:
-				sa->Assign(1, make_intrusive<StringVal>(${request.remote_name.domain_name.name}.length(),
+				sa->Assign(1, zeek::make_intrusive<StringVal>(${request.remote_name.domain_name.name}.length(),
 				                         (const char*) ${request.remote_name.domain_name.name}.data()));
 				break;
 
 			case 4:
-				sa->Assign(0, make_intrusive<AddrVal>(IPAddr(IPv6, (const uint32_t*) ${request.remote_name.ipv6}, IPAddr::Network)));
+				sa->Assign(0, zeek::make_intrusive<AddrVal>(IPAddr(IPv6, (const uint32_t*) ${request.remote_name.ipv6}, IPAddr::Network)));
 				break;
 
 			default:
@@ -123,22 +123,22 @@ refine connection SOCKS_Conn += {
 	function socks5_reply(reply: SOCKS5_Reply): bool
 		%{
 		static auto socks_address = zeek::id::find_type<zeek::RecordType>("SOCKS::Address");
-		auto sa = make_intrusive<RecordVal>(socks_address);
+		auto sa = zeek::make_intrusive<RecordVal>(socks_address);
 
 		// This is dumb and there must be a better way (checking for presence of a field)...
 		switch ( ${reply.bound.addr_type} )
 			{
 			case 1:
-				sa->Assign(0, make_intrusive<AddrVal>(htonl(${reply.bound.ipv4})));
+				sa->Assign(0, zeek::make_intrusive<AddrVal>(htonl(${reply.bound.ipv4})));
 				break;
 
 			case 3:
-				sa->Assign(1, make_intrusive<StringVal>(${reply.bound.domain_name.name}.length(),
+				sa->Assign(1, zeek::make_intrusive<StringVal>(${reply.bound.domain_name.name}.length(),
 				                         (const char*) ${reply.bound.domain_name.name}.data()));
 				break;
 
 			case 4:
-				sa->Assign(0, make_intrusive<AddrVal>(IPAddr(IPv6, (const uint32_t*) ${reply.bound.ipv6}, IPAddr::Network)));
+				sa->Assign(0, zeek::make_intrusive<AddrVal>(IPAddr(IPv6, (const uint32_t*) ${reply.bound.ipv6}, IPAddr::Network)));
 				break;
 
 			default:
@@ -164,8 +164,8 @@ refine connection SOCKS_Conn += {
 		if ( ! socks_login_userpass_request )
 			return true;
 
-		auto user = make_intrusive<StringVal>(${request.username}.length(), (const char*) ${request.username}.begin());
-		auto pass = make_intrusive<StringVal>(${request.password}.length(), (const char*) ${request.password}.begin());
+		auto user = zeek::make_intrusive<StringVal>(${request.username}.length(), (const char*) ${request.username}.begin());
+		auto pass = zeek::make_intrusive<StringVal>(${request.password}.length(), (const char*) ${request.password}.begin());
 
 		zeek::BifEvent::enqueue_socks_login_userpass_request(bro_analyzer(),
 		                                               bro_analyzer()->Conn(),
diff --git a/src/analyzer/protocol/ssh/ssh-analyzer.pac b/src/analyzer/protocol/ssh/ssh-analyzer.pac
index e3064e08a0..f400b60f04 100644
--- a/src/analyzer/protocol/ssh/ssh-analyzer.pac
+++ b/src/analyzer/protocol/ssh/ssh-analyzer.pac
@@ -5,14 +5,14 @@
 %}
 
 %header{
-IntrusivePtr<VectorVal> name_list_to_vector(const bytestring& nl);
+zeek::IntrusivePtr<VectorVal> name_list_to_vector(const bytestring& nl);
 %}
 
 %code{
 // Copied from IRC_Analyzer::SplitWords
-IntrusivePtr<VectorVal> name_list_to_vector(const bytestring& nl)
+zeek::IntrusivePtr<VectorVal> name_list_to_vector(const bytestring& nl)
 	{
-	auto vv = make_intrusive<VectorVal>(zeek::id::string_vec);
+	auto vv = zeek::make_intrusive<VectorVal>(zeek::id::string_vec);
 
 	string name_list = std_str(nl);
 	if ( name_list.size() < 1 )
@@ -32,7 +32,7 @@ IntrusivePtr<VectorVal> name_list_to_vector(const bytestring& nl)
 		{
 		word = name_list.substr(start, split_pos - start);
 		if ( word.size() > 0 && word[0] != ',' )
-			vv->Assign(vv->Size(), make_intrusive<StringVal>(word));
+			vv->Assign(vv->Size(), zeek::make_intrusive<StringVal>(word));
 
 		start = split_pos + 1;
 		}
@@ -41,7 +41,7 @@ IntrusivePtr<VectorVal> name_list_to_vector(const bytestring& nl)
 	if ( start < name_list.size() )
 		{
 		word = name_list.substr(start, name_list.size() - start);
-		vv->Assign(vv->Size(), make_intrusive<StringVal>(word));
+		vv->Assign(vv->Size(), zeek::make_intrusive<StringVal>(word));
 		}
 	return vv;
 	}
@@ -70,28 +70,28 @@ refine flow SSH_Flow += {
 		if ( ! ssh_capabilities )
 			return false;
 
-		auto result = make_intrusive<RecordVal>(zeek::BifType::Record::SSH::Capabilities);
+		auto result = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SSH::Capabilities);
 		result->Assign(0, name_list_to_vector(${msg.kex_algorithms.val}));
 		result->Assign(1, name_list_to_vector(${msg.server_host_key_algorithms.val}));
 
-		auto encryption_algs = make_intrusive<RecordVal>(zeek::BifType::Record::SSH::Algorithm_Prefs);
+		auto encryption_algs = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SSH::Algorithm_Prefs);
 		encryption_algs->Assign(0, name_list_to_vector(${msg.encryption_algorithms_client_to_server.val}));
 		encryption_algs->Assign(1, name_list_to_vector(${msg.encryption_algorithms_server_to_client.val}));
 		result->Assign(2, std::move(encryption_algs));
 
-		auto mac_algs = make_intrusive<RecordVal>(zeek::BifType::Record::SSH::Algorithm_Prefs);
+		auto mac_algs = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SSH::Algorithm_Prefs);
 		mac_algs->Assign(0, name_list_to_vector(${msg.mac_algorithms_client_to_server.val}));
 		mac_algs->Assign(1, name_list_to_vector(${msg.mac_algorithms_server_to_client.val}));
 		result->Assign(3, std::move(mac_algs));
 
-		auto compression_algs = make_intrusive<RecordVal>(zeek::BifType::Record::SSH::Algorithm_Prefs);
+		auto compression_algs = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SSH::Algorithm_Prefs);
 		compression_algs->Assign(0, name_list_to_vector(${msg.compression_algorithms_client_to_server.val}));
 		compression_algs->Assign(1, name_list_to_vector(${msg.compression_algorithms_server_to_client.val}));
 		result->Assign(4, std::move(compression_algs));
 
 		if ( ${msg.languages_client_to_server.len} || ${msg.languages_server_to_client.len} )
 			{
-			auto languages = make_intrusive<RecordVal>(zeek::BifType::Record::SSH::Algorithm_Prefs);
+			auto languages = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SSH::Algorithm_Prefs);
 			if ( ${msg.languages_client_to_server.len} )
 				languages->Assign(0, name_list_to_vector(${msg.languages_client_to_server.val}));
 			if ( ${msg.languages_server_to_client.len} )
diff --git a/src/analyzer/protocol/ssl/proc-client-hello.pac b/src/analyzer/protocol/ssl/proc-client-hello.pac
index c98b0772c6..70b8e25114 100644
--- a/src/analyzer/protocol/ssl/proc-client-hello.pac
+++ b/src/analyzer/protocol/ssl/proc-client-hello.pac
@@ -23,7 +23,7 @@
 			else
 				std::transform(cipher_suites24->begin(), cipher_suites24->end(), std::back_inserter(cipher_suites), to_int());
 
-			auto cipher_vec = make_intrusive<VectorVal>(zeek::id::index_vec);
+			auto cipher_vec = zeek::make_intrusive<VectorVal>(zeek::id::index_vec);
 
 			for ( unsigned int i = 0; i < cipher_suites.size(); ++i )
 				{
@@ -31,7 +31,7 @@
 				cipher_vec->Assign(i, ciph);
 				}
 
-			auto comp_vec = make_intrusive<VectorVal>(zeek::id::index_vec);
+			auto comp_vec = zeek::make_intrusive<VectorVal>(zeek::id::index_vec);
 
 			if ( compression_methods )
 				{
@@ -44,12 +44,11 @@
 
 			zeek::BifEvent::enqueue_ssl_client_hello(bro_analyzer(), bro_analyzer()->Conn(),
 							version, record_version(), ts,
-							make_intrusive<StringVal>(client_random.length(),
-							                          (const char*) client_random.data()),
-							{AdoptRef{}, to_string_val(session_id)},
+							zeek::make_intrusive<StringVal>(client_random.length(),
+							                                (const char*) client_random.data()),
+							{zeek::AdoptRef{}, to_string_val(session_id)},
 							std::move(cipher_vec), std::move(comp_vec));
 			}
 
 		return true;
 		%}
-
diff --git a/src/analyzer/protocol/ssl/proc-server-hello.pac b/src/analyzer/protocol/ssl/proc-server-hello.pac
index 130ff1f9ca..ed81ae0f92 100644
--- a/src/analyzer/protocol/ssl/proc-server-hello.pac
+++ b/src/analyzer/protocol/ssl/proc-server-hello.pac
@@ -28,9 +28,9 @@
 			zeek::BifEvent::enqueue_ssl_server_hello(bro_analyzer(),
 							bro_analyzer()->Conn(),
 							version, record_version(), ts,
-							make_intrusive<StringVal>(server_random.length(),
-							                          (const char*) server_random.data()),
-							{AdoptRef{}, to_string_val(session_id)},
+							zeek::make_intrusive<StringVal>(server_random.length(),
+										        (const char*) server_random.data()),
+							{zeek::AdoptRef{}, to_string_val(session_id)},
 							ciphers->size()==0 ? 0 : ciphers->at(0), comp_method);
 
 			delete ciphers;
@@ -38,4 +38,3 @@
 
 		return true;
 		%}
-
diff --git a/src/analyzer/protocol/ssl/ssl-dtls-analyzer.pac b/src/analyzer/protocol/ssl/ssl-dtls-analyzer.pac
index 47d664ef99..f91ed8dbd1 100644
--- a/src/analyzer/protocol/ssl/ssl-dtls-analyzer.pac
+++ b/src/analyzer/protocol/ssl/ssl-dtls-analyzer.pac
@@ -76,7 +76,7 @@ refine connection SSL_Conn += {
 		if ( ssl_heartbeat )
 			zeek::BifEvent::enqueue_ssl_heartbeat(bro_analyzer(),
 				bro_analyzer()->Conn(), ${rec.is_orig}, ${rec.length}, type, payload_length,
-				make_intrusive<StringVal>(data.length(), (const char*) data.data()));
+				zeek::make_intrusive<StringVal>(data.length(), (const char*) data.data()));
 		return true;
 		%}
 
diff --git a/src/analyzer/protocol/ssl/tls-handshake-analyzer.pac b/src/analyzer/protocol/ssl/tls-handshake-analyzer.pac
index e0ae9bdb5a..957a41ccd2 100644
--- a/src/analyzer/protocol/ssl/tls-handshake-analyzer.pac
+++ b/src/analyzer/protocol/ssl/tls-handshake-analyzer.pac
@@ -37,7 +37,7 @@ refine connection Handshake_Conn += {
 			zeek::BifEvent::enqueue_ssl_session_ticket_handshake(bro_analyzer(),
 							bro_analyzer()->Conn(),
 							${rec.ticket_lifetime_hint},
-							make_intrusive<StringVal>(${rec.data}.length(), (const char*) ${rec.data}.data()));
+							zeek::make_intrusive<StringVal>(${rec.data}.length(), (const char*) ${rec.data}.data()));
 			}
 		return true;
 		%}
@@ -66,7 +66,7 @@ refine connection Handshake_Conn += {
 		if ( ssl_extension )
 			zeek::BifEvent::enqueue_ssl_extension(bro_analyzer(),
 						bro_analyzer()->Conn(), ${rec.is_orig}, type,
-						make_intrusive<StringVal>(length, reinterpret_cast<const char*>(data)));
+						zeek::make_intrusive<StringVal>(length, reinterpret_cast<const char*>(data)));
 		return true;
 		%}
 
@@ -75,7 +75,7 @@ refine connection Handshake_Conn += {
 		if ( ! ssl_extension_ec_point_formats )
 			return true;
 
-		auto points = make_intrusive<VectorVal>(zeek::id::index_vec);
+		auto points = zeek::make_intrusive<VectorVal>(zeek::id::index_vec);
 
 		if ( point_format_list )
 			{
@@ -94,7 +94,7 @@ refine connection Handshake_Conn += {
 		if ( ! ssl_extension_elliptic_curves )
 			return true;
 
-		auto curves = make_intrusive<VectorVal>(zeek::id::index_vec);
+		auto curves = zeek::make_intrusive<VectorVal>(zeek::id::index_vec);
 
 		if ( list )
 			{
@@ -113,7 +113,7 @@ refine connection Handshake_Conn += {
 		if ( ! ssl_extension_key_share )
 			return true;
 
-		auto nglist = make_intrusive<VectorVal>(zeek::id::index_vec);
+		auto nglist = zeek::make_intrusive<VectorVal>(zeek::id::index_vec);
 
 		if ( keyshare )
 			{
@@ -131,7 +131,7 @@ refine connection Handshake_Conn += {
 		if ( ! ssl_extension_key_share )
 			return true;
 
-		auto nglist = make_intrusive<VectorVal>(zeek::id::index_vec);
+		auto nglist = zeek::make_intrusive<VectorVal>(zeek::id::index_vec);
 
 		nglist->Assign(0u, val_mgr->Count(keyshare->namedgroup()));
 		zeek::BifEvent::enqueue_ssl_extension_key_share(bro_analyzer(), bro_analyzer()->Conn(), ${rec.is_orig}, std::move(nglist));
@@ -143,7 +143,7 @@ refine connection Handshake_Conn += {
 		if ( ! ssl_extension_key_share )
 			return true;
 
-		auto nglist = make_intrusive<VectorVal>(zeek::id::index_vec);
+		auto nglist = zeek::make_intrusive<VectorVal>(zeek::id::index_vec);
 
 		nglist->Assign(0u, val_mgr->Count(namedgroup));
 		zeek::BifEvent::enqueue_ssl_extension_key_share(bro_analyzer(), bro_analyzer()->Conn(), ${rec.is_orig}, std::move(nglist));
@@ -155,13 +155,13 @@ refine connection Handshake_Conn += {
 		if ( ! ssl_extension_signature_algorithm )
 			return true;
 
-		auto slist = make_intrusive<VectorVal>(zeek::id::find_type<zeek::VectorType>("signature_and_hashalgorithm_vec"));
+		auto slist = zeek::make_intrusive<VectorVal>(zeek::id::find_type<zeek::VectorType>("signature_and_hashalgorithm_vec"));
 
 		if ( supported_signature_algorithms )
 			{
 			for ( unsigned int i = 0; i < supported_signature_algorithms->size(); ++i )
 				{
-				auto el = make_intrusive<RecordVal>(zeek::BifType::Record::SSL::SignatureAndHashAlgorithm);
+				auto el = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SSL::SignatureAndHashAlgorithm);
 				el->Assign(0, val_mgr->Count((*supported_signature_algorithms)[i]->HashAlgorithm()));
 				el->Assign(1, val_mgr->Count((*supported_signature_algorithms)[i]->SignatureAlgorithm()));
 				slist->Assign(i, std::move(el));
@@ -178,12 +178,12 @@ refine connection Handshake_Conn += {
 		if ( ! ssl_extension_application_layer_protocol_negotiation )
 			return true;
 
-		auto plist = make_intrusive<VectorVal>(zeek::id::string_vec);
+		auto plist = zeek::make_intrusive<VectorVal>(zeek::id::string_vec);
 
 		if ( protocols )
 			{
 			for ( unsigned int i = 0; i < protocols->size(); ++i )
-				plist->Assign(i, make_intrusive<StringVal>((*protocols)[i]->name().length(), (const char*) (*protocols)[i]->name().data()));
+				plist->Assign(i, zeek::make_intrusive<StringVal>((*protocols)[i]->name().length(), (const char*) (*protocols)[i]->name().data()));
 			}
 
 		zeek::BifEvent::enqueue_ssl_extension_application_layer_protocol_negotiation(bro_analyzer(), bro_analyzer()->Conn(),
@@ -194,7 +194,7 @@ refine connection Handshake_Conn += {
 
 	function proc_server_name(rec: HandshakeRecord, list: ServerName[]) : bool
 		%{
-		auto servers = make_intrusive<VectorVal>(zeek::id::string_vec);
+		auto servers = zeek::make_intrusive<VectorVal>(zeek::id::string_vec);
 
 		if ( list )
 			{
@@ -208,7 +208,7 @@ refine connection Handshake_Conn += {
 					}
 
 				if ( servername->host_name() )
-					servers->Assign(j++, make_intrusive<StringVal>(servername->host_name()->host_name().length(), (const char*) servername->host_name()->host_name().data()));
+					servers->Assign(j++, zeek::make_intrusive<StringVal>(servername->host_name()->host_name().length(), (const char*) servername->host_name()->host_name().data()));
 				else
 					bro_analyzer()->Weird("Empty server_name extension in ssl connection");
 				}
@@ -226,7 +226,7 @@ refine connection Handshake_Conn += {
 		if ( ! ssl_extension_supported_versions )
 			return true;
 
-		auto versions = make_intrusive<VectorVal>(zeek::id::index_vec);
+		auto versions = zeek::make_intrusive<VectorVal>(zeek::id::index_vec);
 
 		if ( versions_list )
 			{
@@ -245,7 +245,7 @@ refine connection Handshake_Conn += {
 		if ( ! ssl_extension_supported_versions )
 			return true;
 
-		auto versions = make_intrusive<VectorVal>(zeek::id::index_vec);
+		auto versions = zeek::make_intrusive<VectorVal>(zeek::id::index_vec);
 		versions->Assign(0u, val_mgr->Count(version));
 
 		zeek::BifEvent::enqueue_ssl_extension_supported_versions(bro_analyzer(), bro_analyzer()->Conn(),
@@ -259,7 +259,7 @@ refine connection Handshake_Conn += {
 		if ( ! ssl_extension_psk_key_exchange_modes )
 			return true;
 
-		auto modes = make_intrusive<VectorVal>(zeek::id::index_vec);
+		auto modes = zeek::make_intrusive<VectorVal>(zeek::id::index_vec);
 
 		if ( mode_list )
 			{
@@ -317,7 +317,7 @@ refine connection Handshake_Conn += {
 				zeek::BifEvent::enqueue_ssl_stapled_ocsp(bro_analyzer(),
 				        bro_analyzer()->Conn(),
 				        ${rec.is_orig},
-				        make_intrusive<StringVal>(response.length(), (const char*) response.data()));
+				        zeek::make_intrusive<StringVal>(response.length(), (const char*) response.data()));
 
 			file_mgr->EndOfFile(file_id);
 			}
@@ -338,11 +338,11 @@ refine connection Handshake_Conn += {
 			zeek::BifEvent::enqueue_ssl_ecdh_server_params(bro_analyzer(),
 			                                         bro_analyzer()->Conn(),
 			                                         ${kex.params.curve},
-			                                         make_intrusive<StringVal>(${kex.params.point}.length(), (const char*)${kex.params.point}.data()));
+			                                         zeek::make_intrusive<StringVal>(${kex.params.point}.length(), (const char*)${kex.params.point}.data()));
 
 		if ( ssl_server_signature )
 			{
-			auto ha = make_intrusive<RecordVal>(zeek::BifType::Record::SSL::SignatureAndHashAlgorithm);
+			auto ha = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SSL::SignatureAndHashAlgorithm);
 
 			if ( ${kex.signed_params.uses_signature_and_hashalgorithm} )
 				{
@@ -359,7 +359,7 @@ refine connection Handshake_Conn += {
 			zeek::BifEvent::enqueue_ssl_server_signature(bro_analyzer(),
 			                                       bro_analyzer()->Conn(),
 			                                       std::move(ha),
-			                                       make_intrusive<StringVal>(${kex.signed_params.signature}.length(), (const char*)(${kex.signed_params.signature}).data()));
+			                                       zeek::make_intrusive<StringVal>(${kex.signed_params.signature}.length(), (const char*)(${kex.signed_params.signature}).data()));
 			}
 
 		return true;
@@ -374,7 +374,7 @@ refine connection Handshake_Conn += {
 			zeek::BifEvent::enqueue_ssl_ecdh_server_params(bro_analyzer(),
 			                                         bro_analyzer()->Conn(),
 			                                         ${kex.params.curve},
-			                                         make_intrusive<StringVal>(${kex.params.point}.length(), (const char*)${kex.params.point}.data()));
+			                                         zeek::make_intrusive<StringVal>(${kex.params.point}.length(), (const char*)${kex.params.point}.data()));
 
 		return true;
 		%}
@@ -384,7 +384,7 @@ refine connection Handshake_Conn += {
 		if ( ssl_rsa_client_pms )
 			zeek::BifEvent::enqueue_ssl_rsa_client_pms(bro_analyzer(),
 			                                     bro_analyzer()->Conn(),
-			                                     make_intrusive<StringVal>(rsa_pms.length(), (const char*)rsa_pms.data()));
+			                                     zeek::make_intrusive<StringVal>(rsa_pms.length(), (const char*)rsa_pms.data()));
 
 		return true;
 		%}
@@ -394,7 +394,7 @@ refine connection Handshake_Conn += {
 		if ( ssl_dh_client_params )
 			zeek::BifEvent::enqueue_ssl_dh_client_params(bro_analyzer(),
 			                                       bro_analyzer()->Conn(),
-			                                       make_intrusive<StringVal>(Yc.length(), (const char*)Yc.data()));
+			                                       zeek::make_intrusive<StringVal>(Yc.length(), (const char*)Yc.data()));
 
 		return true;
 		%}
@@ -404,7 +404,7 @@ refine connection Handshake_Conn += {
 		if ( ssl_ecdh_client_params )
 			zeek::BifEvent::enqueue_ssl_ecdh_client_params(bro_analyzer(),
 			                                         bro_analyzer()->Conn(),
-			                                         make_intrusive<StringVal>(point.length(), (const char*)point.data()));
+			                                         zeek::make_intrusive<StringVal>(point.length(), (const char*)point.data()));
 
 		return true;
 		%}
@@ -414,17 +414,17 @@ refine connection Handshake_Conn += {
 		if ( ! ssl_extension_signed_certificate_timestamp )
 			return true;
 
-		auto ha = make_intrusive<RecordVal>(zeek::BifType::Record::SSL::SignatureAndHashAlgorithm);
+		auto ha = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SSL::SignatureAndHashAlgorithm);
 		ha->Assign(0, val_mgr->Count(digitally_signed_algorithms->HashAlgorithm()));
 		ha->Assign(1, val_mgr->Count(digitally_signed_algorithms->SignatureAlgorithm()));
 
 		zeek::BifEvent::enqueue_ssl_extension_signed_certificate_timestamp(bro_analyzer(),
 			bro_analyzer()->Conn(), ${rec.is_orig},
 			version,
-			make_intrusive<StringVal>(logid.length(), reinterpret_cast<const char*>(logid.begin())),
+			zeek::make_intrusive<StringVal>(logid.length(), reinterpret_cast<const char*>(logid.begin())),
 			timestamp,
 			std::move(ha),
-			make_intrusive<StringVal>(digitally_signed_signature.length(), reinterpret_cast<const char*>(digitally_signed_signature.begin()))
+			zeek::make_intrusive<StringVal>(digitally_signed_signature.length(), reinterpret_cast<const char*>(digitally_signed_signature.begin()))
 		);
 
 		return true;
@@ -435,14 +435,14 @@ refine connection Handshake_Conn += {
 		if ( ssl_ecdh_server_params )
 			zeek::BifEvent::enqueue_ssl_dh_server_params(bro_analyzer(),
 			  bro_analyzer()->Conn(),
-			  make_intrusive<StringVal>(p.length(), (const char*) p.data()),
-			  make_intrusive<StringVal>(g.length(), (const char*) g.data()),
-			  make_intrusive<StringVal>(Ys.length(), (const char*) Ys.data())
+			  zeek::make_intrusive<StringVal>(p.length(), (const char*) p.data()),
+			  zeek::make_intrusive<StringVal>(g.length(), (const char*) g.data()),
+			  zeek::make_intrusive<StringVal>(Ys.length(), (const char*) Ys.data())
 			  );
 
 		if ( ssl_server_signature )
 			{
-			auto ha = make_intrusive<RecordVal>(zeek::BifType::Record::SSL::SignatureAndHashAlgorithm);
+			auto ha = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SSL::SignatureAndHashAlgorithm);
 
 			if ( ${signed_params.uses_signature_and_hashalgorithm} )
 				{
@@ -458,7 +458,7 @@ refine connection Handshake_Conn += {
 
 			zeek::BifEvent::enqueue_ssl_server_signature(bro_analyzer(),
 			  bro_analyzer()->Conn(), std::move(ha),
-			  make_intrusive<StringVal>(${signed_params.signature}.length(), (const char*)(${signed_params.signature}).data())
+			  zeek::make_intrusive<StringVal>(${signed_params.signature}.length(), (const char*)(${signed_params.signature}).data())
 			  );
 			}
 
@@ -470,9 +470,9 @@ refine connection Handshake_Conn += {
 		if ( ssl_dh_server_params )
 			zeek::BifEvent::enqueue_ssl_dh_server_params(bro_analyzer(),
 			  bro_analyzer()->Conn(),
-			  make_intrusive<StringVal>(p.length(), (const char*) p.data()),
-			  make_intrusive<StringVal>(g.length(), (const char*) g.data()),
-			  make_intrusive<StringVal>(Ys.length(), (const char*) Ys.data())
+			  zeek::make_intrusive<StringVal>(p.length(), (const char*) p.data()),
+			  zeek::make_intrusive<StringVal>(g.length(), (const char*) g.data()),
+			  zeek::make_intrusive<StringVal>(Ys.length(), (const char*) Ys.data())
 			  );
 
 		return true;
@@ -492,25 +492,25 @@ refine connection Handshake_Conn += {
 		if ( ! ssl_extension_pre_shared_key_server_hello )
 			return true;
 
-		auto slist = make_intrusive<VectorVal>(zeek::id::find_type<zeek::VectorType>("psk_identity_vec"));
+		auto slist = zeek::make_intrusive<VectorVal>(zeek::id::find_type<zeek::VectorType>("psk_identity_vec"));
 
 		if ( identities && identities->identities() )
 			{
 			for ( auto&& identity : *(identities->identities()) )
 				{
-				auto el = make_intrusive<RecordVal>(zeek::BifType::Record::SSL::PSKIdentity);
-				el->Assign(0, make_intrusive<StringVal>(identity->identity().length(), (const char*) identity->identity().data()));
+				auto el = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::SSL::PSKIdentity);
+				el->Assign(0, zeek::make_intrusive<StringVal>(identity->identity().length(), (const char*) identity->identity().data()));
 				el->Assign(1, val_mgr->Count(identity->obfuscated_ticket_age()));
 				slist->Assign(slist->Size(), std::move(el));
 				}
 			}
 
-		auto blist = make_intrusive<VectorVal>(zeek::id::string_vec);
+		auto blist = zeek::make_intrusive<VectorVal>(zeek::id::string_vec);
 
 		if ( binders && binders->binders() )
 			{
 			for ( auto&& binder : *(binders->binders()) )
-				blist->Assign(blist->Size(), make_intrusive<StringVal>(binder->binder().length(), (const char*) binder->binder().data()));
+				blist->Assign(blist->Size(), zeek::make_intrusive<StringVal>(binder->binder().length(), (const char*) binder->binder().data()));
 			}
 
 		zeek::BifEvent::enqueue_ssl_extension_pre_shared_key_client_hello(bro_analyzer(), bro_analyzer()->Conn(),
diff --git a/src/analyzer/protocol/syslog/syslog-analyzer.pac b/src/analyzer/protocol/syslog/syslog-analyzer.pac
index f464abf3b3..ec684ed115 100644
--- a/src/analyzer/protocol/syslog/syslog-analyzer.pac
+++ b/src/analyzer/protocol/syslog/syslog-analyzer.pac
@@ -20,7 +20,7 @@ flow Syslog_Flow
 			    connection()->bro_analyzer()->Conn(),
 			    ${m.PRI.facility},
 			    ${m.PRI.severity},
-			    make_intrusive<StringVal>(${m.msg}.length(), (const char*)${m.msg}.begin())
+			    zeek::make_intrusive<StringVal>(${m.msg}.length(), (const char*)${m.msg}.begin())
 			    );
 		else
 			zeek::BifEvent::enqueue_syslog_message(
@@ -28,7 +28,7 @@ flow Syslog_Flow
 			    connection()->bro_analyzer()->Conn(),
 			    999,
 			    999,
-			    make_intrusive<StringVal>(${m.msg}.length(), (const char*)${m.msg}.begin())
+			    zeek::make_intrusive<StringVal>(${m.msg}.length(), (const char*)${m.msg}.begin())
 			    );
 
 		return true;
diff --git a/src/analyzer/protocol/tcp/TCP.cc b/src/analyzer/protocol/tcp/TCP.cc
index 4415566c01..dbbfec478c 100644
--- a/src/analyzer/protocol/tcp/TCP.cc
+++ b/src/analyzer/protocol/tcp/TCP.cc
@@ -789,13 +789,13 @@ void TCP_Analyzer::GeneratePacketEvent(
 	EnqueueConnEvent(tcp_packet,
 		ConnVal(),
 		val_mgr->Bool(is_orig),
-		make_intrusive<StringVal>(flags.AsString()),
+		zeek::make_intrusive<StringVal>(flags.AsString()),
 		val_mgr->Count(rel_seq),
 		val_mgr->Count(flags.ACK() ? rel_ack : 0),
 		val_mgr->Count(len),
 		// We need the min() here because Ethernet padding can lead to
 		// caplen > len.
-		make_intrusive<StringVal>(std::min(caplen, len), (const char*) data)
+		zeek::make_intrusive<StringVal>(std::min(caplen, len), (const char*) data)
 	);
 	}
 
@@ -1104,7 +1104,7 @@ void TCP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
 		if ( connection_SYN_packet )
 			EnqueueConnEvent(connection_SYN_packet,
 				ConnVal(),
-				IntrusivePtr{NewRef{}, SYN_vals}
+				zeek::IntrusivePtr{zeek::NewRef{}, SYN_vals}
 			);
 
 		Unref(SYN_vals);
@@ -1356,23 +1356,23 @@ int TCP_Analyzer::ParseTCPOptions(const struct tcphdr* tcp, bool is_orig)
 
 	if ( tcp_options )
 		{
-		auto option_list = make_intrusive<VectorVal>(zeek::BifType::Vector::TCP::OptionList);
+		auto option_list = zeek::make_intrusive<VectorVal>(zeek::BifType::Vector::TCP::OptionList);
 
-		auto add_option_data = [](const IntrusivePtr<RecordVal>& rv, const u_char* odata, int olen)
+		auto add_option_data = [](const zeek::IntrusivePtr<RecordVal>& rv, const u_char* odata, int olen)
 			{
 			if ( olen <= 2 )
 				return;
 
 			auto data_len = olen - 2;
 			auto data = reinterpret_cast<const char*>(odata + 2);
-			rv->Assign(2, make_intrusive<StringVal>(data_len, data));
+			rv->Assign(2, zeek::make_intrusive<StringVal>(data_len, data));
 			};
 
 		for ( const auto& o : opts )
 			{
 			auto kind = o[0];
 			auto length = kind < 2 ? 1 : o[1];
-			auto option_record = make_intrusive<RecordVal>(zeek::BifType::Record::TCP::Option);
+			auto option_record = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::TCP::Option);
 			option_list->Assign(option_list->Size(), option_record);
 			option_record->Assign(0, val_mgr->Count(kind));
 			option_record->Assign(1, val_mgr->Count(length));
@@ -1423,7 +1423,7 @@ int TCP_Analyzer::ParseTCPOptions(const struct tcphdr* tcp, bool is_orig)
 					auto p = reinterpret_cast<const uint32_t*>(o + 2);
 					auto num_pointers = (length - 2) / 4;
 					auto vt = zeek::id::index_vec;
-					auto sack = make_intrusive<VectorVal>(std::move(vt));
+					auto sack = zeek::make_intrusive<VectorVal>(std::move(vt));
 
 					for ( auto i = 0; i < num_pointers; ++i )
 						sack->Assign(sack->Size(), val_mgr->Count(ntohl(p[i])));
@@ -1584,7 +1584,7 @@ void TCP_Analyzer::ConnDeleteTimer(double t)
 	Conn()->DeleteTimer(t);
 	}
 
-void TCP_Analyzer::SetContentsFile(unsigned int direction, IntrusivePtr<BroFile> f)
+void TCP_Analyzer::SetContentsFile(unsigned int direction, zeek::IntrusivePtr<BroFile> f)
 	{
 	if ( direction == CONTENTS_NONE )
 		{
@@ -1601,7 +1601,7 @@ void TCP_Analyzer::SetContentsFile(unsigned int direction, IntrusivePtr<BroFile>
 		}
 	}
 
-IntrusivePtr<BroFile> TCP_Analyzer::GetContentsFile(unsigned int direction) const
+zeek::IntrusivePtr<BroFile> TCP_Analyzer::GetContentsFile(unsigned int direction) const
 	{
 	switch ( direction ) {
 	case CONTENTS_NONE:
@@ -2119,8 +2119,8 @@ void TCPStats_Analyzer::Done()
 	if ( conn_stats )
 		EnqueueConnEvent(conn_stats,
 			ConnVal(),
-			IntrusivePtr{AdoptRef{}, orig_stats->BuildStats()},
-			IntrusivePtr{AdoptRef{}, resp_stats->BuildStats()}
+			zeek::IntrusivePtr{zeek::AdoptRef{}, orig_stats->BuildStats()},
+			zeek::IntrusivePtr{zeek::AdoptRef{}, resp_stats->BuildStats()}
 		);
 	}
 
diff --git a/src/analyzer/protocol/tcp/TCP.h b/src/analyzer/protocol/tcp/TCP.h
index 2100eda181..364bd740e1 100644
--- a/src/analyzer/protocol/tcp/TCP.h
+++ b/src/analyzer/protocol/tcp/TCP.h
@@ -60,8 +60,8 @@ public:
 	// the test is whether it has any outstanding, un-acked data.
 	bool DataPending(TCP_Endpoint* closing_endp);
 
-	void SetContentsFile(unsigned int direction, IntrusivePtr<BroFile> f) override;
-	IntrusivePtr<BroFile> GetContentsFile(unsigned int direction) const override;
+	void SetContentsFile(unsigned int direction, zeek::IntrusivePtr<BroFile> f) override;
+	zeek::IntrusivePtr<BroFile> GetContentsFile(unsigned int direction) const override;
 
 	// From Analyzer.h
 	void UpdateConnVal(RecordVal *conn_val) override;
diff --git a/src/analyzer/protocol/tcp/TCP_Endpoint.cc b/src/analyzer/protocol/tcp/TCP_Endpoint.cc
index 04749932b4..3d5eeb0817 100644
--- a/src/analyzer/protocol/tcp/TCP_Endpoint.cc
+++ b/src/analyzer/protocol/tcp/TCP_Endpoint.cc
@@ -240,7 +240,7 @@ bool TCP_Endpoint::DataSent(double t, uint64_t seq, int len, int caplen,
 				tcp_analyzer->EnqueueConnEvent(contents_file_write_failure,
 					Conn()->ConnVal(),
 					val_mgr->Bool(IsOrig()),
-					make_intrusive<StringVal>(buf)
+					zeek::make_intrusive<StringVal>(buf)
 				);
 			}
 		}
@@ -254,7 +254,7 @@ void TCP_Endpoint::AckReceived(uint64_t seq)
 		contents_processor->AckReceived(seq);
 	}
 
-void TCP_Endpoint::SetContentsFile(IntrusivePtr<BroFile> f)
+void TCP_Endpoint::SetContentsFile(zeek::IntrusivePtr<BroFile> f)
 	{
 	contents_file = std::move(f);
 	contents_start_seq = ToRelativeSeqSpace(last_seq, seq_wraps);
diff --git a/src/analyzer/protocol/tcp/TCP_Endpoint.h b/src/analyzer/protocol/tcp/TCP_Endpoint.h
index 9e90f0919d..521859be96 100644
--- a/src/analyzer/protocol/tcp/TCP_Endpoint.h
+++ b/src/analyzer/protocol/tcp/TCP_Endpoint.h
@@ -187,8 +187,8 @@ public:
 
 	void AckReceived(uint64_t seq);
 
-	void SetContentsFile(IntrusivePtr<BroFile> f);
-	const IntrusivePtr<BroFile>& GetContentsFile() const	{ return contents_file; }
+	void SetContentsFile(zeek::IntrusivePtr<BroFile> f);
+	const zeek::IntrusivePtr<BroFile>& GetContentsFile() const	{ return contents_file; }
 
 	// Codes used for tracking history.  For responders, we shift these
 	// over by 16 bits in order to fit both originator and responder
@@ -211,7 +211,7 @@ public:
 	TCP_Endpoint* peer;
 	TCP_Reassembler* contents_processor;
 	TCP_Analyzer* tcp_analyzer;
-	IntrusivePtr<BroFile> contents_file;
+	zeek::IntrusivePtr<BroFile> contents_file;
 	uint32_t checksum_base;
 
 	double start_time, last_time;
diff --git a/src/analyzer/protocol/tcp/TCP_Reassembler.cc b/src/analyzer/protocol/tcp/TCP_Reassembler.cc
index 2e9ef2c84d..f6278dcebb 100644
--- a/src/analyzer/protocol/tcp/TCP_Reassembler.cc
+++ b/src/analyzer/protocol/tcp/TCP_Reassembler.cc
@@ -92,7 +92,7 @@ uint64_t TCP_Reassembler::NumUndeliveredBytes() const
 	return last_block.upper - last_reassem_seq;
 	}
 
-void TCP_Reassembler::SetContentsFile(IntrusivePtr<BroFile> f)
+void TCP_Reassembler::SetContentsFile(zeek::IntrusivePtr<BroFile> f)
 	{
 	if ( ! f->IsOpen() )
 		{
@@ -317,7 +317,7 @@ void TCP_Reassembler::MatchUndelivered(uint64_t up_to_seq, bool use_last_upper)
 		}
 	}
 
-void TCP_Reassembler::RecordToSeq(uint64_t start_seq, uint64_t stop_seq, const IntrusivePtr<BroFile>& f)
+void TCP_Reassembler::RecordToSeq(uint64_t start_seq, uint64_t stop_seq, const zeek::IntrusivePtr<BroFile>& f)
 	{
 	auto it = block_list.Begin();
 
@@ -348,7 +348,7 @@ void TCP_Reassembler::RecordToSeq(uint64_t start_seq, uint64_t stop_seq, const I
 			RecordGap(last_seq, stop_seq, f);
 	}
 
-void TCP_Reassembler::RecordBlock(const DataBlock& b, const IntrusivePtr<BroFile>& f)
+void TCP_Reassembler::RecordBlock(const DataBlock& b, const zeek::IntrusivePtr<BroFile>& f)
 	{
 	if ( f->Write((const char*) b.block, b.Size()) )
 		return;
@@ -359,11 +359,11 @@ void TCP_Reassembler::RecordBlock(const DataBlock& b, const IntrusivePtr<BroFile
 		tcp_analyzer->EnqueueConnEvent(contents_file_write_failure,
 			Endpoint()->Conn()->ConnVal(),
 			val_mgr->Bool(IsOrig()),
-			make_intrusive<StringVal>("TCP reassembler content write failure")
+			zeek::make_intrusive<StringVal>("TCP reassembler content write failure")
 		);
 	}
 
-void TCP_Reassembler::RecordGap(uint64_t start_seq, uint64_t upper_seq, const IntrusivePtr<BroFile>& f)
+void TCP_Reassembler::RecordGap(uint64_t start_seq, uint64_t upper_seq, const zeek::IntrusivePtr<BroFile>& f)
 	{
 	if ( f->Write(fmt("\n<<gap %" PRIu64">>\n", upper_seq - start_seq)) )
 		return;
@@ -374,7 +374,7 @@ void TCP_Reassembler::RecordGap(uint64_t start_seq, uint64_t upper_seq, const In
 		tcp_analyzer->EnqueueConnEvent(contents_file_write_failure,
 			Endpoint()->Conn()->ConnVal(),
 			val_mgr->Bool(IsOrig()),
-			make_intrusive<StringVal>("TCP reassembler gap write failure")
+			zeek::make_intrusive<StringVal>("TCP reassembler gap write failure")
 		);
 	}
 
@@ -453,9 +453,9 @@ void TCP_Reassembler::Overlap(const u_char* b1, const u_char* b2, uint64_t n)
 
 		tcp_analyzer->EnqueueConnEvent(rexmit_inconsistency,
 			tcp_analyzer->ConnVal(),
-			make_intrusive<StringVal>(b1_s),
-			make_intrusive<StringVal>(b2_s),
-			make_intrusive<StringVal>(flags.AsString())
+			zeek::make_intrusive<StringVal>(b1_s),
+			zeek::make_intrusive<StringVal>(b2_s),
+			zeek::make_intrusive<StringVal>(flags.AsString())
 		);
 		}
 	}
@@ -611,7 +611,7 @@ void TCP_Reassembler::DeliverBlock(uint64_t seq, int len, const u_char* data)
 			tcp_analyzer->ConnVal(),
 			val_mgr->Bool(IsOrig()),
 			val_mgr->Count(seq),
-			make_intrusive<StringVal>(len, (const char*) data)
+			zeek::make_intrusive<StringVal>(len, (const char*) data)
 		);
 
 	// Q. Can we say this because it is already checked in DataSent()?
diff --git a/src/analyzer/protocol/tcp/TCP_Reassembler.h b/src/analyzer/protocol/tcp/TCP_Reassembler.h
index 1ff6b835d1..b7f0327f07 100644
--- a/src/analyzer/protocol/tcp/TCP_Reassembler.h
+++ b/src/analyzer/protocol/tcp/TCP_Reassembler.h
@@ -49,8 +49,8 @@ public:
 	// from waiting_on_hole above; and is computed in a different fashion).
 	uint64_t NumUndeliveredBytes() const;
 
-	void SetContentsFile(IntrusivePtr<BroFile> f);
-	const IntrusivePtr<BroFile>& GetContentsFile() const	{ return record_contents_file; }
+	void SetContentsFile(zeek::IntrusivePtr<BroFile> f);
+	const zeek::IntrusivePtr<BroFile>& GetContentsFile() const	{ return record_contents_file; }
 
 	void MatchUndelivered(uint64_t up_to_seq, bool use_last_upper);
 
@@ -89,9 +89,9 @@ private:
 	void Undelivered(uint64_t up_to_seq) override;
 	void Gap(uint64_t seq, uint64_t len);
 
-	void RecordToSeq(uint64_t start_seq, uint64_t stop_seq, const IntrusivePtr<BroFile>& f);
-	void RecordBlock(const DataBlock& b, const IntrusivePtr<BroFile>& f);
-	void RecordGap(uint64_t start_seq, uint64_t upper_seq, const IntrusivePtr<BroFile>& f);
+	void RecordToSeq(uint64_t start_seq, uint64_t stop_seq, const zeek::IntrusivePtr<BroFile>& f);
+	void RecordBlock(const DataBlock& b, const zeek::IntrusivePtr<BroFile>& f);
+	void RecordGap(uint64_t start_seq, uint64_t upper_seq, const zeek::IntrusivePtr<BroFile>& f);
 
 	void BlockInserted(DataBlockMap::const_iterator it) override;
 	void Overlap(const u_char* b1, const u_char* b2, uint64_t n) override;
@@ -108,7 +108,7 @@ private:
 	bool in_delivery;
 	analyzer::tcp::TCP_Flags flags;
 
-	IntrusivePtr<BroFile> record_contents_file;	// file on which to reassemble contents
+	zeek::IntrusivePtr<BroFile> record_contents_file;	// file on which to reassemble contents
 
 	Analyzer* dst_analyzer;
 	TCP_Analyzer* tcp_analyzer;
diff --git a/src/analyzer/protocol/tcp/functions.bif b/src/analyzer/protocol/tcp/functions.bif
index 043dbbdafa..743bbb22ca 100644
--- a/src/analyzer/protocol/tcp/functions.bif
+++ b/src/analyzer/protocol/tcp/functions.bif
@@ -101,7 +101,7 @@ function set_contents_file%(cid: conn_id, direction: count, f: file%): bool
 	if ( ! c )
 		return val_mgr->False();
 
-	c->GetRootAnalyzer()->SetContentsFile(direction, {NewRef{}, f});
+	c->GetRootAnalyzer()->SetContentsFile(direction, {zeek::NewRef{}, f});
 	return val_mgr->True();
 	%}
 
@@ -127,7 +127,7 @@ function get_contents_file%(cid: conn_id, direction: count%): file
 		auto cf = c->GetRootAnalyzer()->GetContentsFile(direction);
 
 		if ( cf )
-			return make_intrusive<Val>(std::move(cf));
+			return zeek::make_intrusive<Val>(std::move(cf));
 		}
 
 	// Return some sort of error value.
@@ -136,5 +136,5 @@ function get_contents_file%(cid: conn_id, direction: count%): file
 	else
 		builtin_error("no contents file for given direction");
 
-	return make_intrusive<Val>(make_intrusive<BroFile>(stderr, "-", "w"));
+	return zeek::make_intrusive<Val>(zeek::make_intrusive<BroFile>(stderr, "-", "w"));
 	%}
diff --git a/src/analyzer/protocol/teredo/Teredo.cc b/src/analyzer/protocol/teredo/Teredo.cc
index 263aa4d334..e5feec521a 100644
--- a/src/analyzer/protocol/teredo/Teredo.cc
+++ b/src/analyzer/protocol/teredo/Teredo.cc
@@ -96,24 +96,24 @@ bool TeredoEncapsulation::DoParse(const u_char* data, int& len,
 	return false;
 	}
 
-IntrusivePtr<RecordVal> TeredoEncapsulation::BuildVal(const IP_Hdr* inner) const
+zeek::IntrusivePtr<RecordVal> TeredoEncapsulation::BuildVal(const IP_Hdr* inner) const
 	{
 	static auto teredo_hdr_type = zeek::id::find_type<zeek::RecordType>("teredo_hdr");
 	static auto teredo_auth_type = zeek::id::find_type<zeek::RecordType>("teredo_auth");
 	static auto teredo_origin_type = zeek::id::find_type<zeek::RecordType>("teredo_origin");
 
-	auto teredo_hdr = make_intrusive<RecordVal>(teredo_hdr_type);
+	auto teredo_hdr = zeek::make_intrusive<RecordVal>(teredo_hdr_type);
 
 	if ( auth )
 		{
-		auto teredo_auth = make_intrusive<RecordVal>(teredo_auth_type);
+		auto teredo_auth = zeek::make_intrusive<RecordVal>(teredo_auth_type);
 		uint8_t id_len = *((uint8_t*)(auth + 2));
 		uint8_t au_len = *((uint8_t*)(auth + 3));
 		uint64_t nonce = ntohll(*((uint64_t*)(auth + 4 + id_len + au_len)));
 		uint8_t conf = *((uint8_t*)(auth + 4 + id_len + au_len + 8));
-		teredo_auth->Assign(0, make_intrusive<StringVal>(
+		teredo_auth->Assign(0, zeek::make_intrusive<StringVal>(
 		    new BroString(auth + 4, id_len, true)));
-		teredo_auth->Assign(1, make_intrusive<StringVal>(
+		teredo_auth->Assign(1, zeek::make_intrusive<StringVal>(
 		    new BroString(auth + 4 + id_len, au_len, true)));
 		teredo_auth->Assign(2, val_mgr->Count(nonce));
 		teredo_auth->Assign(3, val_mgr->Count(conf));
@@ -122,11 +122,11 @@ IntrusivePtr<RecordVal> TeredoEncapsulation::BuildVal(const IP_Hdr* inner) const
 
 	if ( origin_indication )
 		{
-		auto teredo_origin = make_intrusive<RecordVal>(teredo_origin_type);
+		auto teredo_origin = zeek::make_intrusive<RecordVal>(teredo_origin_type);
 		uint16_t port = ntohs(*((uint16_t*)(origin_indication + 2))) ^ 0xFFFF;
 		uint32_t addr = ntohl(*((uint32_t*)(origin_indication + 4))) ^ 0xFFFFFFFF;
 		teredo_origin->Assign(0, val_mgr->Port(port, TRANSPORT_UDP));
-		teredo_origin->Assign(1, make_intrusive<AddrVal>(htonl(addr)));
+		teredo_origin->Assign(1, zeek::make_intrusive<AddrVal>(htonl(addr)));
 		teredo_hdr->Assign(1, std::move(teredo_origin));
 		}
 
@@ -194,7 +194,7 @@ void Teredo_Analyzer::DeliverPacket(int len, const u_char* data, bool orig,
 		return;
 		}
 
-	IntrusivePtr<Val> teredo_hdr;
+	zeek::IntrusivePtr<Val> teredo_hdr;
 
 	if ( teredo_packet )
 		{
diff --git a/src/analyzer/protocol/teredo/Teredo.h b/src/analyzer/protocol/teredo/Teredo.h
index 6b9975537c..4a13ee6f5d 100644
--- a/src/analyzer/protocol/teredo/Teredo.h
+++ b/src/analyzer/protocol/teredo/Teredo.h
@@ -74,7 +74,7 @@ public:
 	const u_char* Authentication() const
 		{ return auth; }
 
-	IntrusivePtr<RecordVal> BuildVal(const IP_Hdr* inner) const;
+	zeek::IntrusivePtr<RecordVal> BuildVal(const IP_Hdr* inner) const;
 
 protected:
 	bool DoParse(const u_char* data, int& len, bool found_orig, bool found_au);
diff --git a/src/analyzer/protocol/udp/UDP.cc b/src/analyzer/protocol/udp/UDP.cc
index a320b9ee76..ce6e78637a 100644
--- a/src/analyzer/protocol/udp/UDP.cc
+++ b/src/analyzer/protocol/udp/UDP.cc
@@ -170,7 +170,7 @@ void UDP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
 			EnqueueConnEvent(udp_contents,
 				ConnVal(),
 				val_mgr->Bool(is_orig),
-				make_intrusive<StringVal>(len, (const char*) data)
+				zeek::make_intrusive<StringVal>(len, (const char*) data)
 			);
 		}
 
diff --git a/src/binpac_bro-lib.pac b/src/binpac_bro-lib.pac
index 5b5b7594b1..b2398d1e4b 100644
--- a/src/binpac_bro-lib.pac
+++ b/src/binpac_bro-lib.pac
@@ -7,7 +7,7 @@
 %}
 
 %code{
-IntrusivePtr<StringVal> utf16_to_utf8_val(Connection* conn, const bytestring& utf16)
+zeek::IntrusivePtr<StringVal> utf16_to_utf8_val(Connection* conn, const bytestring& utf16)
 	{
 	std::string resultstring;
 
@@ -52,7 +52,7 @@ IntrusivePtr<StringVal> utf16_to_utf8_val(Connection* conn, const bytestring& ut
 
 	// We're relying on no nulls being in the string.
 	//return new StringVal(resultstring.length(), (const char *) resultstring.data());
-	return make_intrusive<StringVal>(resultstring.c_str());
+	return zeek::make_intrusive<StringVal>(resultstring.c_str());
 	}
 
 StringVal* utf16_bytestring_to_utf8_val(Connection* conn, const bytestring& utf16)
diff --git a/src/binpac_bro.h b/src/binpac_bro.h
index 1d84ad0810..49dddf56b4 100644
--- a/src/binpac_bro.h
+++ b/src/binpac_bro.h
@@ -35,12 +35,12 @@ inline StringVal* bytestring_to_val(const_bytestring const &str)
 	return new StringVal(str.length(), (const char*) str.begin());
 	}
 
-inline IntrusivePtr<StringVal> to_stringval(const_bytestring const& str)
+inline zeek::IntrusivePtr<StringVal> to_stringval(const_bytestring const& str)
     {
-	return make_intrusive<StringVal>(str.length(), (const char*) str.begin());
+	return zeek::make_intrusive<StringVal>(str.length(), (const char*) str.begin());
     }
 
-IntrusivePtr<StringVal> utf16_to_utf8_val(Connection* conn, const bytestring& utf16);
+zeek::IntrusivePtr<StringVal> utf16_to_utf8_val(Connection* conn, const bytestring& utf16);
 
 [[deprecated("Remove in v4.1.  Use utf16_to_utf8_val() instead.")]]
 StringVal* utf16_bytestring_to_utf8_val(Connection* conn, const bytestring& utf16);
diff --git a/src/broker/Data.cc b/src/broker/Data.cc
index 0b1f6006c4..c686fc8abf 100644
--- a/src/broker/Data.cc
+++ b/src/broker/Data.cc
@@ -14,11 +14,11 @@
 
 using namespace std;
 
-IntrusivePtr<zeek::OpaqueType> bro_broker::opaque_of_data_type;
-IntrusivePtr<zeek::OpaqueType> bro_broker::opaque_of_set_iterator;
-IntrusivePtr<zeek::OpaqueType> bro_broker::opaque_of_table_iterator;
-IntrusivePtr<zeek::OpaqueType> bro_broker::opaque_of_vector_iterator;
-IntrusivePtr<zeek::OpaqueType> bro_broker::opaque_of_record_iterator;
+zeek::IntrusivePtr<zeek::OpaqueType> bro_broker::opaque_of_data_type;
+zeek::IntrusivePtr<zeek::OpaqueType> bro_broker::opaque_of_set_iterator;
+zeek::IntrusivePtr<zeek::OpaqueType> bro_broker::opaque_of_table_iterator;
+zeek::IntrusivePtr<zeek::OpaqueType> bro_broker::opaque_of_vector_iterator;
+zeek::IntrusivePtr<zeek::OpaqueType> bro_broker::opaque_of_record_iterator;
 
 static bool data_type_check(const broker::data& d, zeek::Type* t);
 
@@ -73,7 +73,7 @@ TEST_CASE("converting Broker to Zeek protocol constants")
 	}
 
 struct val_converter {
-	using result_type = IntrusivePtr<Val>;
+	using result_type = zeek::IntrusivePtr<Val>;
 
 	zeek::Type* type;
 
@@ -108,7 +108,7 @@ struct val_converter {
 	result_type operator()(double a)
 		{
 		if ( type->Tag() == zeek::TYPE_DOUBLE )
-			return make_intrusive<DoubleVal>(a);
+			return zeek::make_intrusive<DoubleVal>(a);
 		return nullptr;
 		}
 
@@ -116,13 +116,13 @@ struct val_converter {
 		{
 		switch ( type->Tag() ) {
 		case zeek::TYPE_STRING:
-			return make_intrusive<StringVal>(a.size(), a.data());
+			return zeek::make_intrusive<StringVal>(a.size(), a.data());
 		case zeek::TYPE_FILE:
 			{
 			auto file = BroFile::Get(a.data());
 
 			if ( file )
-				return make_intrusive<Val>(std::move(file));
+				return zeek::make_intrusive<Val>(std::move(file));
 
 			return nullptr;
 			}
@@ -136,7 +136,7 @@ struct val_converter {
 		if ( type->Tag() == zeek::TYPE_ADDR )
 			{
 			auto bits = reinterpret_cast<const in6_addr*>(&a.bytes());
-			return make_intrusive<AddrVal>(IPAddr(*bits));
+			return zeek::make_intrusive<AddrVal>(IPAddr(*bits));
 			}
 
 		return nullptr;
@@ -147,7 +147,7 @@ struct val_converter {
 		if ( type->Tag() == zeek::TYPE_SUBNET )
 			{
 			auto bits = reinterpret_cast<const in6_addr*>(&a.network().bytes());
-			return make_intrusive<SubNetVal>(IPPrefix(IPAddr(*bits), a.length()));
+			return zeek::make_intrusive<SubNetVal>(IPPrefix(IPAddr(*bits), a.length()));
 			}
 
 		return nullptr;
@@ -168,7 +168,7 @@ struct val_converter {
 
 		using namespace std::chrono;
 		auto s = duration_cast<broker::fractional_seconds>(a.time_since_epoch());
-		return make_intrusive<TimeVal>(s.count());
+		return zeek::make_intrusive<TimeVal>(s.count());
 		}
 
 	result_type operator()(broker::timespan& a)
@@ -178,7 +178,7 @@ struct val_converter {
 
 		using namespace std::chrono;
 		auto s = duration_cast<broker::fractional_seconds>(a);
-		return make_intrusive<IntervalVal>(s.count());
+		return zeek::make_intrusive<IntervalVal>(s.count());
 		}
 
 	result_type operator()(broker::enum_value& a)
@@ -204,7 +204,7 @@ struct val_converter {
 			return nullptr;
 
 		auto tt = type->AsTableType();
-		auto rval = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, tt});
+		auto rval = zeek::make_intrusive<TableVal>(zeek::IntrusivePtr{zeek::NewRef{}, tt});
 
 		for ( auto& item : a )
 			{
@@ -237,7 +237,7 @@ struct val_converter {
 			if ( expected_index_types.size() != indices->size() )
 				return nullptr;
 
-			auto list_val = make_intrusive<ListVal>(zeek::TYPE_ANY);
+			auto list_val = zeek::make_intrusive<ListVal>(zeek::TYPE_ANY);
 
 			for ( auto i = 0u; i < indices->size(); ++i )
 				{
@@ -263,7 +263,7 @@ struct val_converter {
 			return nullptr;
 
 		auto tt = type->AsTableType();
-		auto rval = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, tt});
+		auto rval = zeek::make_intrusive<TableVal>(zeek::IntrusivePtr{zeek::NewRef{}, tt});
 
 		for ( auto& item : a )
 			{
@@ -296,7 +296,7 @@ struct val_converter {
 			if ( expected_index_types.size() != indices->size() )
 				return nullptr;
 
-			auto list_val = make_intrusive<ListVal>(zeek::TYPE_ANY);
+			auto list_val = zeek::make_intrusive<ListVal>(zeek::TYPE_ANY);
 
 			for ( auto i = 0u; i < indices->size(); ++i )
 				{
@@ -326,7 +326,7 @@ struct val_converter {
 		if ( type->Tag() == zeek::TYPE_VECTOR )
 			{
 			auto vt = type->AsVectorType();
-			auto rval = make_intrusive<VectorVal>(IntrusivePtr{NewRef{}, vt});
+			auto rval = zeek::make_intrusive<VectorVal>(zeek::IntrusivePtr{zeek::NewRef{}, vt});
 
 			for ( auto& item : a )
 				{
@@ -383,7 +383,7 @@ struct val_converter {
 		else if ( type->Tag() == zeek::TYPE_RECORD )
 			{
 			auto rt = type->AsRecordType();
-			auto rval = make_intrusive<RecordVal>(IntrusivePtr{NewRef{}, rt});
+			auto rval = zeek::make_intrusive<RecordVal>(zeek::IntrusivePtr{zeek::NewRef{}, rt});
 			auto idx = 0u;
 
 			for ( auto i = 0u; i < static_cast<size_t>(rt->NumFields()); ++i )
@@ -432,7 +432,7 @@ struct val_converter {
 				return nullptr;
 				}
 
-			auto rval = make_intrusive<PatternVal>(re);
+			auto rval = zeek::make_intrusive<PatternVal>(re);
 			return rval;
 			}
 		else if ( type->Tag() == zeek::TYPE_OPAQUE )
@@ -779,7 +779,7 @@ static bool data_type_check(const broker::data& d, zeek::Type* t)
 	return caf::visit(type_checker{t}, d);
 	}
 
-IntrusivePtr<Val> bro_broker::data_to_val(broker::data d, zeek::Type* type)
+zeek::IntrusivePtr<Val> bro_broker::data_to_val(broker::data d, zeek::Type* type)
 	{
 	if ( type->Tag() == zeek::TYPE_ANY )
 		return bro_broker::make_data_val(move(d));
@@ -1010,28 +1010,28 @@ broker::expected<broker::data> bro_broker::val_to_data(const Val* v)
 	return broker::ec::invalid_data;
 	}
 
-IntrusivePtr<RecordVal> bro_broker::make_data_val(Val* v)
+zeek::IntrusivePtr<RecordVal> bro_broker::make_data_val(Val* v)
 	{
-	auto rval = make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
+	auto rval = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 	auto data = val_to_data(v);
 
 	if  ( data )
-		rval->Assign(0, make_intrusive<DataVal>(move(*data)));
+		rval->Assign(0, zeek::make_intrusive<DataVal>(move(*data)));
 	else
 		reporter->Warning("did not get a value from val_to_data");
 
 	return rval;
 	}
 
-IntrusivePtr<RecordVal> bro_broker::make_data_val(broker::data d)
+zeek::IntrusivePtr<RecordVal> bro_broker::make_data_val(broker::data d)
 	{
-	auto rval = make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
-	rval->Assign(0, make_intrusive<DataVal>(move(d)));
+	auto rval = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
+	rval->Assign(0, zeek::make_intrusive<DataVal>(move(d)));
 	return rval;
 	}
 
 struct data_type_getter {
-	using result_type = IntrusivePtr<EnumVal>;
+	using result_type = zeek::IntrusivePtr<EnumVal>;
 
 	result_type operator()(broker::none)
 		{
@@ -1112,7 +1112,7 @@ struct data_type_getter {
 		}
 };
 
-IntrusivePtr<EnumVal> bro_broker::get_data_type(RecordVal* v, Frame* frame)
+zeek::IntrusivePtr<EnumVal> bro_broker::get_data_type(RecordVal* v, Frame* frame)
 	{
 	return caf::visit(data_type_getter{}, opaque_field_to_data(v, frame));
 	}
@@ -1142,12 +1142,12 @@ bool bro_broker::DataVal::canCastTo(zeek::Type* t) const
 	return data_type_check(data, t);
 	}
 
-IntrusivePtr<Val> bro_broker::DataVal::castTo(zeek::Type* t)
+zeek::IntrusivePtr<Val> bro_broker::DataVal::castTo(zeek::Type* t)
 	{
 	return data_to_val(data, t);
 	}
 
-const IntrusivePtr<zeek::Type>& bro_broker::DataVal::ScriptDataType()
+const zeek::IntrusivePtr<zeek::Type>& bro_broker::DataVal::ScriptDataType()
 	{
 	static auto script_data_type = zeek::id::find_type("Broker::Data");
 	return script_data_type;
diff --git a/src/broker/Data.h b/src/broker/Data.h
index 33c6a6e327..1b6ec33148 100644
--- a/src/broker/Data.h
+++ b/src/broker/Data.h
@@ -17,11 +17,11 @@ struct Field;
 
 namespace bro_broker {
 
-extern IntrusivePtr<zeek::OpaqueType> opaque_of_data_type;
-extern IntrusivePtr<zeek::OpaqueType> opaque_of_set_iterator;
-extern IntrusivePtr<zeek::OpaqueType> opaque_of_table_iterator;
-extern IntrusivePtr<zeek::OpaqueType> opaque_of_vector_iterator;
-extern IntrusivePtr<zeek::OpaqueType> opaque_of_record_iterator;
+extern zeek::IntrusivePtr<zeek::OpaqueType> opaque_of_data_type;
+extern zeek::IntrusivePtr<zeek::OpaqueType> opaque_of_set_iterator;
+extern zeek::IntrusivePtr<zeek::OpaqueType> opaque_of_table_iterator;
+extern zeek::IntrusivePtr<zeek::OpaqueType> opaque_of_vector_iterator;
+extern zeek::IntrusivePtr<zeek::OpaqueType> opaque_of_record_iterator;
 
 /**
  * Convert a broker port protocol to a bro port protocol.
@@ -34,14 +34,14 @@ TransportProto to_bro_port_proto(broker::port::protocol tp);
  * @return a Broker::Data value, where the optional field is set if the conversion
  * was possible, else it is unset.
  */
-IntrusivePtr<RecordVal> make_data_val(Val* v);
+zeek::IntrusivePtr<RecordVal> make_data_val(Val* v);
 
 /**
  * Create a Broker::Data value from a Broker data value.
  * @param d the Broker value to wrap in an opaque type.
  * @return a Broker::Data value that wraps the Broker value.
  */
-IntrusivePtr<RecordVal> make_data_val(broker::data d);
+zeek::IntrusivePtr<RecordVal> make_data_val(broker::data d);
 
 /**
  * Get the type of Broker data that Broker::Data wraps.
@@ -49,7 +49,7 @@ IntrusivePtr<RecordVal> make_data_val(broker::data d);
  * @param frame used to get location info upon error.
  * @return a Broker::DataType value.
  */
-IntrusivePtr<EnumVal> get_data_type(RecordVal* v, Frame* frame);
+zeek::IntrusivePtr<EnumVal> get_data_type(RecordVal* v, Frame* frame);
 
 /**
  * Convert a Bro value to a Broker data value.
@@ -65,7 +65,7 @@ broker::expected<broker::data> val_to_data(const Val* v);
  * @return a pointer to a new Bro value or a nullptr if the conversion was not
  * possible.
  */
-IntrusivePtr<Val> data_to_val(broker::data d, zeek::Type* type);
+zeek::IntrusivePtr<Val> data_to_val(broker::data d, zeek::Type* type);
 
 /**
  * Convert a Bro threading::Value to a Broker data value.
@@ -109,13 +109,13 @@ public:
 
 	void ValDescribe(ODesc* d) const override;
 
-	IntrusivePtr<Val> castTo(zeek::Type* t);
+	zeek::IntrusivePtr<Val> castTo(zeek::Type* t);
 	bool canCastTo(zeek::Type* t) const;
 
 	// Returns the Bro type that scripts use to represent a Broker data
 	// instance. This may be wrapping the opaque value inside another
 	// type.
-	static const IntrusivePtr<zeek::Type>& ScriptDataType();
+	static const zeek::IntrusivePtr<zeek::Type>& ScriptDataType();
 
 	broker::data data;
 
diff --git a/src/broker/Manager.cc b/src/broker/Manager.cc
index 36631f13a2..26a8b0c66e 100644
--- a/src/broker/Manager.cc
+++ b/src/broker/Manager.cc
@@ -152,13 +152,13 @@ void Manager::InitPostScript()
 	log_id_type = zeek::id::find_type("Log::ID")->AsEnumType();
 	writer_id_type = zeek::id::find_type("Log::Writer")->AsEnumType();
 
-	opaque_of_data_type = make_intrusive<zeek::OpaqueType>("Broker::Data");
-	opaque_of_set_iterator = make_intrusive<zeek::OpaqueType>("Broker::SetIterator");
-	opaque_of_table_iterator = make_intrusive<zeek::OpaqueType>("Broker::TableIterator");
-	opaque_of_vector_iterator = make_intrusive<zeek::OpaqueType>("Broker::VectorIterator");
-	opaque_of_record_iterator = make_intrusive<zeek::OpaqueType>("Broker::RecordIterator");
-	opaque_of_store_handle = make_intrusive<zeek::OpaqueType>("Broker::Store");
-	vector_of_data_type = make_intrusive<zeek::VectorType>(zeek::id::find_type("Broker::Data"));
+	opaque_of_data_type = zeek::make_intrusive<zeek::OpaqueType>("Broker::Data");
+	opaque_of_set_iterator = zeek::make_intrusive<zeek::OpaqueType>("Broker::SetIterator");
+	opaque_of_table_iterator = zeek::make_intrusive<zeek::OpaqueType>("Broker::TableIterator");
+	opaque_of_vector_iterator = zeek::make_intrusive<zeek::OpaqueType>("Broker::VectorIterator");
+	opaque_of_record_iterator = zeek::make_intrusive<zeek::OpaqueType>("Broker::RecordIterator");
+	opaque_of_store_handle = zeek::make_intrusive<zeek::OpaqueType>("Broker::Store");
+	vector_of_data_type = zeek::make_intrusive<zeek::VectorType>(zeek::id::find_type("Broker::Data"));
 
 	// Register as a "dont-count" source first, we may change that later.
 	iosource_mgr->Register(this, true);
@@ -553,8 +553,8 @@ bool Manager::PublishLogWrite(EnumVal* stream, EnumVal* writer, string path, int
 	std::string serial_data(data, len);
 	free(data);
 
-	auto v = log_topic_func->Invoke(IntrusivePtr{NewRef{}, stream},
-	                                make_intrusive<StringVal>(path));
+	auto v = log_topic_func->Invoke(zeek::IntrusivePtr{zeek::NewRef{}, stream},
+	                                zeek::make_intrusive<StringVal>(path));
 
 	if ( ! v )
 		{
@@ -701,7 +701,7 @@ bool Manager::AutoUnpublishEvent(const string& topic, Val* event)
 RecordVal* Manager::MakeEvent(val_list* args, Frame* frame)
 	{
 	auto rval = new RecordVal(zeek::BifType::Record::Broker::Event);
-	auto arg_vec = make_intrusive<VectorVal>(vector_of_data_type);
+	auto arg_vec = zeek::make_intrusive<VectorVal>(vector_of_data_type);
 	rval->Assign(1, arg_vec);
 	Func* func = nullptr;
 	scoped_reporter_location srl{frame};
@@ -737,7 +737,7 @@ RecordVal* Manager::MakeEvent(val_list* args, Frame* frame)
 				return rval;
 				}
 
-			rval->Assign(0, make_intrusive<StringVal>(func->Name()));
+			rval->Assign(0, zeek::make_intrusive<StringVal>(func->Name()));
 			continue;
 			}
 
@@ -753,10 +753,10 @@ RecordVal* Manager::MakeEvent(val_list* args, Frame* frame)
 			return rval;
 			}
 
-		IntrusivePtr<RecordVal> data_val;
+		zeek::IntrusivePtr<RecordVal> data_val;
 
 		if ( same_type(got_type, bro_broker::DataVal::ScriptDataType()) )
-			data_val = {NewRef{}, (*args)[i]->AsRecordVal()};
+			data_val = {zeek::NewRef{}, (*args)[i]->AsRecordVal()};
 		else
 			data_val = make_data_val((*args)[i]);
 
@@ -1247,24 +1247,24 @@ void Manager::ProcessStatus(broker::status stat)
 		return;
 
 	static auto ei = zeek::id::find_type<zeek::RecordType>("Broker::EndpointInfo");
-	auto endpoint_info = make_intrusive<RecordVal>(ei);
+	auto endpoint_info = zeek::make_intrusive<RecordVal>(ei);
 
 	if ( ctx )
 		{
-		endpoint_info->Assign(0, make_intrusive<StringVal>(to_string(ctx->node)));
+		endpoint_info->Assign(0, zeek::make_intrusive<StringVal>(to_string(ctx->node)));
 		static auto ni = zeek::id::find_type<zeek::RecordType>("Broker::NetworkInfo");
-		auto network_info = make_intrusive<RecordVal>(ni);
+		auto network_info = zeek::make_intrusive<RecordVal>(ni);
 
 		if ( ctx->network )
 			{
-			network_info->Assign(0, make_intrusive<StringVal>(ctx->network->address.data()));
+			network_info->Assign(0, zeek::make_intrusive<StringVal>(ctx->network->address.data()));
 			network_info->Assign(1, val_mgr->Port(ctx->network->port, TRANSPORT_TCP));
 			}
 		else
 			{
 			// TODO: are there any status messages where the ctx->network
 			// is not set and actually could be?
-			network_info->Assign(0, make_intrusive<StringVal>("<unknown>"));
+			network_info->Assign(0, zeek::make_intrusive<StringVal>("<unknown>"));
 			network_info->Assign(1, val_mgr->Port(0, TRANSPORT_TCP));
 			}
 
@@ -1272,7 +1272,7 @@ void Manager::ProcessStatus(broker::status stat)
 		}
 
 	auto str = stat.message();
-	auto msg = make_intrusive<StringVal>(str ? *str : "");
+	auto msg = zeek::make_intrusive<StringVal>(str ? *str : "");
 
 	mgr.Enqueue(event, std::move(endpoint_info), std::move(msg));
 	}
@@ -1353,7 +1353,7 @@ void Manager::ProcessError(broker::error err)
 
 	mgr.Enqueue(Broker::error,
 		zeek::BifType::Enum::Broker::ErrorCode->GetVal(ec),
-		make_intrusive<StringVal>(msg)
+		zeek::make_intrusive<StringVal>(msg)
 	);
 	}
 
diff --git a/src/broker/Manager.h b/src/broker/Manager.h
index 30f917546a..36d9db9216 100644
--- a/src/broker/Manager.h
+++ b/src/broker/Manager.h
@@ -397,7 +397,7 @@ private:
 
 	size_t log_batch_size;
 	Func* log_topic_func;
-	IntrusivePtr<zeek::VectorType> vector_of_data_type;
+	zeek::IntrusivePtr<zeek::VectorType> vector_of_data_type;
 	zeek::EnumType* log_id_type;
 	zeek::EnumType* writer_id_type;
 
diff --git a/src/broker/Store.cc b/src/broker/Store.cc
index 63a63953ef..8047c7d5f7 100644
--- a/src/broker/Store.cc
+++ b/src/broker/Store.cc
@@ -5,9 +5,9 @@
 
 namespace bro_broker {
 
-IntrusivePtr<zeek::OpaqueType> opaque_of_store_handle;
+zeek::IntrusivePtr<zeek::OpaqueType> opaque_of_store_handle;
 
-IntrusivePtr<EnumVal> query_status(bool success)
+zeek::IntrusivePtr<EnumVal> query_status(bool success)
 	{
 	static zeek::EnumType* store_query_status = nullptr;
 	static int success_val;
diff --git a/src/broker/Store.h b/src/broker/Store.h
index 03b6fdd637..eb8d1e37e9 100644
--- a/src/broker/Store.h
+++ b/src/broker/Store.h
@@ -11,24 +11,24 @@
 
 namespace bro_broker {
 
-extern IntrusivePtr<zeek::OpaqueType> opaque_of_store_handle;
+extern zeek::IntrusivePtr<zeek::OpaqueType> opaque_of_store_handle;
 
 /**
  * Create a Broker::QueryStatus value.
  * @param success whether the query status should be set to success or failure.
  * @return a Broker::QueryStatus value.
  */
-IntrusivePtr<EnumVal> query_status(bool success);
+zeek::IntrusivePtr<EnumVal> query_status(bool success);
 
 /**
  * @return a Broker::QueryResult value that has a Broker::QueryStatus indicating
  * a failure.
  */
-inline IntrusivePtr<RecordVal> query_result()
+inline zeek::IntrusivePtr<RecordVal> query_result()
 	{
-	auto rval = make_intrusive<RecordVal>(zeek::BifType::Record::Broker::QueryResult);
+	auto rval = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::Broker::QueryResult);
 	rval->Assign(0, query_status(false));
-	rval->Assign(1, make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data));
+	rval->Assign(1, zeek::make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data));
 	return rval;
 	}
 
@@ -37,9 +37,9 @@ inline IntrusivePtr<RecordVal> query_result()
  * @return a Broker::QueryResult value that has a Broker::QueryStatus indicating
  * a success.
  */
-inline IntrusivePtr<RecordVal> query_result(IntrusivePtr<RecordVal> data)
+inline zeek::IntrusivePtr<RecordVal> query_result(zeek::IntrusivePtr<RecordVal> data)
 	{
-	auto rval = make_intrusive<RecordVal>(zeek::BifType::Record::Broker::QueryResult);
+	auto rval = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::Broker::QueryResult);
 	rval->Assign(0, query_status(true));
 	rval->Assign(1, std::move(data));
 	return rval;
@@ -62,7 +62,7 @@ public:
 		Unref(trigger);
 		}
 
-	void Result(const IntrusivePtr<RecordVal>& result)
+	void Result(const zeek::IntrusivePtr<RecordVal>& result)
 		{
 		trigger->Cache(call, result.get());
 		trigger->Release();
@@ -104,8 +104,8 @@ public:
 
 protected:
 
-	IntrusivePtr<Val> DoClone(CloneState* state) override
-		{ return {NewRef{}, this}; }
+	zeek::IntrusivePtr<Val> DoClone(CloneState* state) override
+		{ return { zeek::NewRef{}, this }; }
 
 	StoreHandleVal()
 		: OpaqueVal(bro_broker::opaque_of_store_handle)
diff --git a/src/broker/comm.bif b/src/broker/comm.bif
index 6b63029f17..6bfc19e87b 100644
--- a/src/broker/comm.bif
+++ b/src/broker/comm.bif
@@ -22,7 +22,7 @@ event Broker::peer_lost%(endpoint: EndpointInfo, msg: string%);
 ## Generated when an error occurs in the Broker sub-system.
 event Broker::error%(code: ErrorCode, msg: string%);
 
-## Enumerates the possible error types. 
+## Enumerates the possible error types.
 enum ErrorCode %{
 	UNSPECIFIED = 1,
 	PEER_INCOMPATIBLE = 2,
@@ -94,7 +94,7 @@ function Broker::__unpeer%(a: string, p: port%): bool
 function Broker::__peers%(%): PeerInfos
 	%{
 	bro_broker::Manager::ScriptScopeGuard ssg;
-	auto rval = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("Broker::PeerInfos"));
+	auto rval = zeek::make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("Broker::PeerInfos"));
 	auto i = 0;
 
 	for ( auto& p : broker_mgr->Peers() )
@@ -102,23 +102,23 @@ function Broker::__peers%(%): PeerInfos
 		const auto& pi = zeek::id::find_type<RecordType>("Broker::PeerInfo");
 		const auto& ei = zeek::id::find_type<RecordType>("Broker::EndpointInfo");
 		const auto& ni = zeek::id::find_type<RecordType>("Broker::NetworkInfo");
-		auto peer_info = make_intrusive<RecordVal>(pi);
-		auto endpoint_info = make_intrusive<RecordVal>(ei);
-		auto network_info = make_intrusive<RecordVal>(ni);
+		auto peer_info = zeek::make_intrusive<RecordVal>(pi);
+		auto endpoint_info = zeek::make_intrusive<RecordVal>(ei);
+		auto network_info = zeek::make_intrusive<RecordVal>(ni);
 		auto n = p.peer.network;
 
 		if ( n )
 			{
-			network_info->Assign(0, make_intrusive<AddrVal>(IPAddr(n->address)));
+			network_info->Assign(0, zeek::make_intrusive<AddrVal>(IPAddr(n->address)));
 			network_info->Assign(1, val_mgr->Port(n->port, TRANSPORT_TCP));
 			}
 		else
 			{
-			network_info->Assign(0, make_intrusive<AddrVal>("0.0.0.0"));
+			network_info->Assign(0, zeek::make_intrusive<AddrVal>("0.0.0.0"));
 			network_info->Assign(1, val_mgr->Port(0, TRANSPORT_TCP));
 			}
 
-		endpoint_info->Assign(0, make_intrusive<StringVal>(to_string(p.peer.node)));
+		endpoint_info->Assign(0, zeek::make_intrusive<StringVal>(to_string(p.peer.node)));
 		endpoint_info->Assign(1, std::move(network_info));
 
 		auto ps = (BifEnum::Broker::PeerStatus)p.status;
@@ -135,5 +135,5 @@ function Broker::__peers%(%): PeerInfos
 function Broker::__node_id%(%): string
 	%{
 	bro_broker::Manager::ScriptScopeGuard ssg;
-	return make_intrusive<StringVal>(broker_mgr->NodeID());
+	return zeek::make_intrusive<StringVal>(broker_mgr->NodeID());
 	%}
diff --git a/src/broker/data.bif b/src/broker/data.bif
index 2091a1cb99..1d2f3ebb27 100644
--- a/src/broker/data.bif
+++ b/src/broker/data.bif
@@ -123,7 +123,7 @@ function Broker::__set_remove%(s: Broker::Data, key: any%): bool
 
 function Broker::__set_iterator%(s: Broker::Data%): opaque of Broker::SetIterator
 	%{
-	return make_intrusive<bro_broker::SetIterator>(s->AsRecordVal(), zeek::TYPE_TABLE, frame);
+	return zeek::make_intrusive<bro_broker::SetIterator>(s->AsRecordVal(), zeek::TYPE_TABLE, frame);
 	%}
 
 function Broker::__set_iterator_last%(it: opaque of Broker::SetIterator%): bool
@@ -146,7 +146,7 @@ function Broker::__set_iterator_next%(it: opaque of Broker::SetIterator%): bool
 function Broker::__set_iterator_value%(it: opaque of Broker::SetIterator%): Broker::Data
 	%{
 	auto set_it = static_cast<bro_broker::SetIterator*>(it);
-	auto rval = make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
+	auto rval = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 
 	if ( set_it->it == set_it->dat.end() )
 		{
@@ -154,7 +154,7 @@ function Broker::__set_iterator_value%(it: opaque of Broker::SetIterator%): Brok
 		return rval;
 		}
 
-	rval->Assign(0, make_intrusive<bro_broker::DataVal>(*set_it->it));
+	rval->Assign(0, zeek::make_intrusive<bro_broker::DataVal>(*set_it->it));
 	return rval;
 	%}
 
@@ -204,7 +204,7 @@ function Broker::__table_insert%(t: Broker::Data, key: any, val: any%): Broker::
 	if ( ! k )
 		{
 		builtin_error("invalid Broker data conversion for key argument");
-		return make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
+		return zeek::make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 		}
 
 	auto v = bro_broker::val_to_data(val);
@@ -212,7 +212,7 @@ function Broker::__table_insert%(t: Broker::Data, key: any, val: any%): Broker::
 	if ( ! v )
 		{
 		builtin_error("invalid Broker data conversion for value argument");
-		return make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
+		return zeek::make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 		}
 
 	try
@@ -225,7 +225,7 @@ function Broker::__table_insert%(t: Broker::Data, key: any, val: any%): Broker::
 	catch (const std::out_of_range&)
 		{
 		table[std::move(*k)] = std::move(*v);
-		return make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
+		return zeek::make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 		}
 	%}
 
@@ -239,13 +239,13 @@ function Broker::__table_remove%(t: Broker::Data, key: any%): Broker::Data
 	if ( ! k )
 		{
 		builtin_error("invalid Broker data conversion for key argument");
-		return make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
+		return zeek::make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 		}
 
 	auto it = table.find(*k);
 
 	if ( it == table.end() )
-		return make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
+		return zeek::make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 	else
 		{
 		auto rval = bro_broker::make_data_val(move(it->second));
@@ -264,20 +264,20 @@ function Broker::__table_lookup%(t: Broker::Data, key: any%): Broker::Data
 	if ( ! k )
 		{
 		builtin_error("invalid Broker data conversion for key argument");
-		return make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
+		return zeek::make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 		}
 
 	auto it = table.find(*k);
 
 	if ( it == table.end() )
-		return make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
+		return zeek::make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 	else
 		return bro_broker::make_data_val(it->second);
 	%}
 
 function Broker::__table_iterator%(t: Broker::Data%): opaque of Broker::TableIterator
 	%{
-	return make_intrusive<bro_broker::TableIterator>(t->AsRecordVal(), zeek::TYPE_TABLE, frame);
+	return zeek::make_intrusive<bro_broker::TableIterator>(t->AsRecordVal(), zeek::TYPE_TABLE, frame);
 	%}
 
 function Broker::__table_iterator_last%(it: opaque of Broker::TableIterator%): bool
@@ -300,9 +300,9 @@ function Broker::__table_iterator_next%(it: opaque of Broker::TableIterator%): b
 function Broker::__table_iterator_value%(it: opaque of Broker::TableIterator%): Broker::TableItem
 	%{
 	auto ti = static_cast<bro_broker::TableIterator*>(it);
-	auto rval = make_intrusive<RecordVal>(zeek::BifType::Record::Broker::TableItem);
-	auto key_val = make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
-	auto val_val = make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
+	auto rval = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::Broker::TableItem);
+	auto key_val = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
+	auto val_val = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 	rval->Assign(0, key_val);
 	rval->Assign(1, val_val);
 
@@ -312,8 +312,8 @@ function Broker::__table_iterator_value%(it: opaque of Broker::TableIterator%):
 		return rval;
 		}
 
-	key_val->Assign(0, make_intrusive<bro_broker::DataVal>(ti->it->first));
-	val_val->Assign(0, make_intrusive<bro_broker::DataVal>(ti->it->second));
+	key_val->Assign(0, zeek::make_intrusive<bro_broker::DataVal>(ti->it->first));
+	val_val->Assign(0, zeek::make_intrusive<bro_broker::DataVal>(ti->it->second));
 	return rval;
 	%}
 
@@ -367,7 +367,7 @@ function Broker::__vector_replace%(v: Broker::Data, idx: count, d: any%): Broker
 		}
 
 	if ( idx >= vec.size() )
-		return make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
+		return zeek::make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 
 	auto rval = bro_broker::make_data_val(move(vec[idx]));
 	vec[idx] = std::move(*item);
@@ -380,7 +380,7 @@ function Broker::__vector_remove%(v: Broker::Data, idx: count%): Broker::Data
 	                                                          zeek::TYPE_VECTOR, frame);
 
 	if ( idx >= vec.size() )
-		return make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
+		return zeek::make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 
 	auto rval = bro_broker::make_data_val(move(vec[idx]));
 	vec.erase(vec.begin() + idx);
@@ -393,14 +393,14 @@ function Broker::__vector_lookup%(v: Broker::Data, idx: count%): Broker::Data
 	                                                          zeek::TYPE_VECTOR, frame);
 
 	if ( idx >= vec.size() )
-		return make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
+		return zeek::make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 
 	return bro_broker::make_data_val(vec[idx]);
 	%}
 
 function Broker::__vector_iterator%(v: Broker::Data%): opaque of Broker::VectorIterator
 	%{
-	return make_intrusive<bro_broker::VectorIterator>(v->AsRecordVal(), zeek::TYPE_VECTOR, frame);
+	return zeek::make_intrusive<bro_broker::VectorIterator>(v->AsRecordVal(), zeek::TYPE_VECTOR, frame);
 	%}
 
 function Broker::__vector_iterator_last%(it: opaque of Broker::VectorIterator%): bool
@@ -423,7 +423,7 @@ function Broker::__vector_iterator_next%(it: opaque of Broker::VectorIterator%):
 function Broker::__vector_iterator_value%(it: opaque of Broker::VectorIterator%): Broker::Data
 	%{
 	auto vi = static_cast<bro_broker::VectorIterator*>(it);
-	auto rval = make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
+	auto rval = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 
 	if ( vi->it == vi->dat.end() )
 		{
@@ -431,7 +431,7 @@ function Broker::__vector_iterator_value%(it: opaque of Broker::VectorIterator%)
 		return rval;
 		}
 
-	rval->Assign(0, make_intrusive<bro_broker::DataVal>(*vi->it));
+	rval->Assign(0, zeek::make_intrusive<bro_broker::DataVal>(*vi->it));
 	return rval;
 	%}
 
@@ -472,14 +472,14 @@ function Broker::__record_lookup%(r: Broker::Data, idx: count%): Broker::Data
 	                                                        zeek::TYPE_RECORD, frame);
 
 	if ( idx >= v.size() || caf::get_if<broker::none>(&v[idx]) )
-		return make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
+		return zeek::make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 
 	return bro_broker::make_data_val(v[idx]);
 	%}
 
 function Broker::__record_iterator%(r: Broker::Data%): opaque of Broker::RecordIterator
 	%{
-	return make_intrusive<bro_broker::RecordIterator>(r->AsRecordVal(), zeek::TYPE_RECORD, frame);
+	return zeek::make_intrusive<bro_broker::RecordIterator>(r->AsRecordVal(), zeek::TYPE_RECORD, frame);
 	%}
 
 function Broker::__record_iterator_last%(it: opaque of Broker::RecordIterator%): bool
@@ -502,7 +502,7 @@ function Broker::__record_iterator_next%(it: opaque of Broker::RecordIterator%):
 function Broker::__record_iterator_value%(it: opaque of Broker::RecordIterator%): Broker::Data
 	%{
 	auto ri = static_cast<bro_broker::RecordIterator*>(it);
-	auto rval = make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
+	auto rval = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 
 	if ( ri->it == ri->dat.end() )
 		{
@@ -513,6 +513,6 @@ function Broker::__record_iterator_value%(it: opaque of Broker::RecordIterator%)
 	if ( caf::get_if<broker::none>(&(*ri->it)) )
 		return rval; // field isn't set
 
-	rval->Assign(0, make_intrusive<bro_broker::DataVal>(*ri->it));
+	rval->Assign(0, zeek::make_intrusive<bro_broker::DataVal>(*ri->it));
 	return rval;
 	%}
diff --git a/src/broker/messaging.bif b/src/broker/messaging.bif
index 0bfa56796e..53b0b0a3d0 100644
--- a/src/broker/messaging.bif
+++ b/src/broker/messaging.bif
@@ -89,7 +89,7 @@ function Broker::make_event%(...%): Broker::Event
 	for ( auto i = 0u; i < bif_args->size(); ++i )
 		args.push_back((*bif_args)[i].get());
 
-	return IntrusivePtr<RecordVal>{AdoptRef{}, broker_mgr->MakeEvent(&args, frame)};
+	return zeek::IntrusivePtr<RecordVal>{zeek::AdoptRef{}, broker_mgr->MakeEvent(&args, frame)};
 	%}
 
 ## Publishes an event at a given topic.
@@ -187,7 +187,7 @@ function Cluster::publish_rr%(pool: Pool, key: string, ...%): bool
 	if ( ! topic_func )
 		topic_func = global_scope()->Find("Cluster::rr_topic")->GetVal()->AsFunc();
 
-	zeek::Args vl{{NewRef{}, pool}, {NewRef{}, key}};
+	zeek::Args vl{{zeek::NewRef{}, pool}, {zeek::NewRef{}, key}};
 	auto topic = topic_func->Invoke(&vl);
 
 	if ( ! topic->AsString()->Len() )
@@ -224,7 +224,7 @@ function Cluster::publish_hrw%(pool: Pool, key: any, ...%): bool
 	if ( ! topic_func )
 		topic_func = global_scope()->Find("Cluster::hrw_topic")->GetVal()->AsFunc();
 
-	zeek::Args vl{{NewRef{}, pool}, {NewRef{}, key}};
+	zeek::Args vl{{zeek::NewRef{}, pool}, {zeek::NewRef{}, key}};
 	auto topic = topic_func->Invoke(&vl);
 
 	if ( ! topic->AsString()->Len() )
diff --git a/src/broker/store.bif b/src/broker/store.bif
index 68262f667b..972b279346 100644
--- a/src/broker/store.bif
+++ b/src/broker/store.bif
@@ -42,13 +42,13 @@ function Broker::__create_master%(id: string, b: BackendType,
 	auto rval = broker_mgr->LookupStore(name);
 
 	if ( rval )
-		return IntrusivePtr<Val>{NewRef{}, rval};
+		return zeek::IntrusivePtr<Val>{zeek::NewRef{}, rval};
 
 	auto e = static_cast<BifEnum::Broker::BackendType>(b->AsEnum());
 	auto type = bro_broker::to_backend_type(e);
 	auto opts = bro_broker::to_backend_options(type, options->AsRecordVal());
 
-	IntrusivePtr<Val> store{AdoptRef{}, broker_mgr->MakeMaster(name, type, std::move(opts))};
+	zeek::IntrusivePtr<Val> store{zeek::AdoptRef{}, broker_mgr->MakeMaster(name, type, std::move(opts))};
 
 	if ( ! store )
 		{
@@ -68,12 +68,12 @@ function Broker::__create_clone%(id: string, resync_interval: interval,
 	auto rval = broker_mgr->LookupStore(name);
 
 	if ( rval )
-		return IntrusivePtr<Val>{NewRef{}, rval};
+		return zeek::IntrusivePtr<Val>{zeek::NewRef{}, rval};
 
-	IntrusivePtr<Val> store {AdoptRef{},
-	                         broker_mgr->MakeClone(name, resync_interval,
-	                                               stale_interval,
-	                                               mutation_buffer_interval)};
+	zeek::IntrusivePtr<Val> store {zeek::AdoptRef{},
+	                               broker_mgr->MakeClone(name, resync_interval,
+	                                                     stale_interval,
+	                                                     mutation_buffer_interval)};
 
 	if ( ! store )
 		{
@@ -121,7 +121,7 @@ function Broker::__store_name%(h: opaque of Broker::Store%): string
 		}
 
 	auto handle = static_cast<bro_broker::StoreHandleVal*>(h);
-	return make_intrusive<StringVal>(handle->store.name());
+	return zeek::make_intrusive<StringVal>(handle->store.name());
 	%}
 
 function Broker::__exists%(h: opaque of Broker::Store,
@@ -293,7 +293,7 @@ function Broker::__get_index_from_value%(h: opaque of Broker::Store,
 		builtin_error("invalid Broker data conversion for index argument");
 		return bro_broker::query_result();
 		}
-	
+
 	auto trigger = frame->GetTrigger();
 
 	if ( ! trigger )
diff --git a/src/file_analysis/Analyzer.cc b/src/file_analysis/Analyzer.cc
index 27066ba826..6cb37b506d 100644
--- a/src/file_analysis/Analyzer.cc
+++ b/src/file_analysis/Analyzer.cc
@@ -19,7 +19,7 @@ void file_analysis::Analyzer::SetAnalyzerTag(const file_analysis::Tag& arg_tag)
 	}
 
 file_analysis::Analyzer::Analyzer(file_analysis::Tag arg_tag,
-                                  IntrusivePtr<RecordVal> arg_args,
+                                  zeek::IntrusivePtr<RecordVal> arg_args,
                                   File* arg_file)
 	: tag(arg_tag),
 	  args(std::move(arg_args)),
@@ -30,16 +30,16 @@ file_analysis::Analyzer::Analyzer(file_analysis::Tag arg_tag,
 	id = ++id_counter;
 	}
 
-file_analysis::Analyzer::Analyzer(IntrusivePtr<RecordVal> arg_args, File* arg_file)
+file_analysis::Analyzer::Analyzer(zeek::IntrusivePtr<RecordVal> arg_args, File* arg_file)
 	: Analyzer({}, std::move(arg_args), arg_file)
 	{}
 
 file_analysis::Analyzer::Analyzer(file_analysis::Tag arg_tag,
                                   RecordVal* arg_args,
                                   File* arg_file)
-	: Analyzer(arg_tag, {NewRef{}, arg_args}, arg_file)
+	: Analyzer(arg_tag, {zeek::NewRef{}, arg_args}, arg_file)
 	{}
 
 file_analysis::Analyzer::Analyzer(RecordVal* arg_args, File* arg_file)
-	: Analyzer({}, {NewRef{}, arg_args}, arg_file)
+	: Analyzer({}, {zeek::NewRef{}, arg_args}, arg_file)
 	{}
diff --git a/src/file_analysis/Analyzer.h b/src/file_analysis/Analyzer.h
index fe0b2bf521..b78b587041 100644
--- a/src/file_analysis/Analyzer.h
+++ b/src/file_analysis/Analyzer.h
@@ -95,7 +95,7 @@ public:
 	/**
 	 * @return the AnalyzerArgs associated with the analyzer.
 	 */
-	const IntrusivePtr<RecordVal>& GetArgs() const
+	const zeek::IntrusivePtr<RecordVal>& GetArgs() const
 		{ return args; }
 
 	[[deprecated("Remove in v4.1.  Use GetArgs().")]]
@@ -151,7 +151,7 @@ protected:
 	 *        tunable options, if any, related to a particular analyzer type.
 	 * @param arg_file the file to which the the analyzer is being attached.
 	 */
-	Analyzer(file_analysis::Tag arg_tag, IntrusivePtr<RecordVal> arg_args,
+	Analyzer(file_analysis::Tag arg_tag, zeek::IntrusivePtr<RecordVal> arg_args,
 	         File* arg_file);
 
 	[[deprecated("Remove in v4.1..  Construct using IntrusivePtr instead.")]]
@@ -166,7 +166,7 @@ protected:
 	 *        tunable options, if any, related to a particular analyzer type.
 	 * @param arg_file the file to which the the analyzer is being attached.
 	 */
-	Analyzer(IntrusivePtr<RecordVal> arg_args, File* arg_file);
+	Analyzer(zeek::IntrusivePtr<RecordVal> arg_args, File* arg_file);
 
 	[[deprecated("Remove in v4.1..  Construct using IntrusivePtr instead.")]]
 	Analyzer(RecordVal* arg_args, File* arg_file);
@@ -175,7 +175,7 @@ private:
 
 	ID id;	/**< Unique instance ID. */
 	file_analysis::Tag tag;	/**< The particular type of the analyzer instance. */
-	IntrusivePtr<RecordVal> args;	/**< \c AnalyzerArgs val gives tunable analyzer params. */
+	zeek::IntrusivePtr<RecordVal> args;	/**< \c AnalyzerArgs val gives tunable analyzer params. */
 	File* file;	/**< The file to which the analyzer is attached. */
 	bool got_stream_delivery;
 	bool skip;
diff --git a/src/file_analysis/AnalyzerSet.cc b/src/file_analysis/AnalyzerSet.cc
index 2f7d5ae6a0..5593be4fe3 100644
--- a/src/file_analysis/AnalyzerSet.cc
+++ b/src/file_analysis/AnalyzerSet.cc
@@ -20,7 +20,7 @@ static void analyzer_del_func(void* v)
 
 AnalyzerSet::AnalyzerSet(File* arg_file) : file(arg_file)
 	{
-	auto t = make_intrusive<zeek::TypeList>();
+	auto t = zeek::make_intrusive<zeek::TypeList>();
 	t->Append(file_mgr->GetTagType());
 	t->Append(zeek::BifType::Record::Files::AnalyzerArgs);
 	analyzer_hash = new CompositeHash(std::move(t));
@@ -41,14 +41,14 @@ AnalyzerSet::~AnalyzerSet()
 	}
 
 Analyzer* AnalyzerSet::Find(const file_analysis::Tag& tag,
-                            IntrusivePtr<RecordVal> args)
+                            zeek::IntrusivePtr<RecordVal> args)
 	{
 	auto key = GetKey(tag, std::move(args));
 	Analyzer* rval = analyzer_map.Lookup(key.get());
 	return rval;
 	}
 
-bool AnalyzerSet::Add(const file_analysis::Tag& tag, IntrusivePtr<RecordVal> args)
+bool AnalyzerSet::Add(const file_analysis::Tag& tag, zeek::IntrusivePtr<RecordVal> args)
 	{
 	auto key = GetKey(tag, args);
 
@@ -72,7 +72,7 @@ bool AnalyzerSet::Add(const file_analysis::Tag& tag, IntrusivePtr<RecordVal> arg
 	}
 
 Analyzer* AnalyzerSet::QueueAdd(const file_analysis::Tag& tag,
-                                IntrusivePtr<RecordVal> args)
+                                zeek::IntrusivePtr<RecordVal> args)
 	{
 	auto key = GetKey(tag, args);
 	file_analysis::Analyzer* a = InstantiateAnalyzer(tag, std::move(args));
@@ -108,7 +108,7 @@ void AnalyzerSet::AddMod::Abort()
 	}
 
 bool AnalyzerSet::Remove(const file_analysis::Tag& tag,
-                         IntrusivePtr<RecordVal> args)
+                         zeek::IntrusivePtr<RecordVal> args)
 	{
 	return Remove(tag, GetKey(tag, std::move(args)));
 	}
@@ -140,7 +140,7 @@ bool AnalyzerSet::Remove(const file_analysis::Tag& tag,
 	}
 
 bool AnalyzerSet::QueueRemove(const file_analysis::Tag& tag,
-                              IntrusivePtr<RecordVal> args)
+                              zeek::IntrusivePtr<RecordVal> args)
 	{
 	auto key = GetKey(tag, std::move(args));
 	auto rval = analyzer_map.Lookup(key.get());
@@ -154,9 +154,9 @@ bool AnalyzerSet::RemoveMod::Perform(AnalyzerSet* set)
 	}
 
 std::unique_ptr<HashKey> AnalyzerSet::GetKey(const file_analysis::Tag& t,
-                                             IntrusivePtr<RecordVal> args) const
+                                             zeek::IntrusivePtr<RecordVal> args) const
 	{
-	auto lv = make_intrusive<ListVal>(zeek::TYPE_ANY);
+	auto lv = zeek::make_intrusive<ListVal>(zeek::TYPE_ANY);
 	lv->Append(t.AsVal());
 	lv->Append(std::move(args));
 	auto key = analyzer_hash->MakeHashKey(*lv, true);
@@ -168,7 +168,7 @@ std::unique_ptr<HashKey> AnalyzerSet::GetKey(const file_analysis::Tag& t,
 	}
 
 file_analysis::Analyzer* AnalyzerSet::InstantiateAnalyzer(const Tag& tag,
-                                                          IntrusivePtr<RecordVal> args) const
+                                                          zeek::IntrusivePtr<RecordVal> args) const
 	{
 	auto  a = file_mgr->InstantiateAnalyzer(tag, std::move(args), file);
 
diff --git a/src/file_analysis/AnalyzerSet.h b/src/file_analysis/AnalyzerSet.h
index c0ef1d6fc0..a18f67bd77 100644
--- a/src/file_analysis/AnalyzerSet.h
+++ b/src/file_analysis/AnalyzerSet.h
@@ -43,7 +43,7 @@ public:
 	 * @param args an \c AnalyzerArgs record.
 	 * @return pointer to an analyzer instance, or a null pointer if not found.
 	 */
-	Analyzer* Find(const file_analysis::Tag& tag, IntrusivePtr<RecordVal> args);
+	Analyzer* Find(const file_analysis::Tag& tag, zeek::IntrusivePtr<RecordVal> args);
 
 	/**
 	 * Attach an analyzer to #file immediately.
@@ -51,7 +51,7 @@ public:
 	 * @param args an \c AnalyzerArgs value which specifies an analyzer.
 	 * @return true if analyzer was instantiated/attached, else false.
 	 */
-	bool Add(const file_analysis::Tag& tag, IntrusivePtr<RecordVal> args);
+	bool Add(const file_analysis::Tag& tag, zeek::IntrusivePtr<RecordVal> args);
 
 	/**
 	 * Queue the attachment of an analyzer to #file.
@@ -61,7 +61,7 @@ public:
 	 * a null pointer.  The caller does *not* take ownership of the memory.
 	 */
 	file_analysis::Analyzer* QueueAdd(const file_analysis::Tag& tag,
-	                                  IntrusivePtr<RecordVal> args);
+	                                  zeek::IntrusivePtr<RecordVal> args);
 
 	/**
 	 * Remove an analyzer from #file immediately.
@@ -69,7 +69,7 @@ public:
 	 * @param args an \c AnalyzerArgs value which specifies an analyzer.
 	 * @return false if analyzer didn't exist and so wasn't removed, else true.
 	 */
-	bool Remove(const file_analysis::Tag& tag, IntrusivePtr<RecordVal> args);
+	bool Remove(const file_analysis::Tag& tag, zeek::IntrusivePtr<RecordVal> args);
 
 	/**
 	 * Queue the removal of an analyzer from #file.
@@ -77,7 +77,7 @@ public:
 	 * @param args an \c AnalyzerArgs value which specifies an analyzer.
 	 * @return true if analyzer exists at time of call, else false;
 	 */
-	bool QueueRemove(const file_analysis::Tag& tag, IntrusivePtr<RecordVal> args);
+	bool QueueRemove(const file_analysis::Tag& tag, zeek::IntrusivePtr<RecordVal> args);
 
 	/**
 	 * Perform all queued modifications to the current analyzer set.
@@ -111,7 +111,7 @@ protected:
 	 * @return the hash key calculated from \a args
 	 */
 	std::unique_ptr<HashKey> GetKey(const file_analysis::Tag& tag,
-	                                IntrusivePtr<RecordVal> args) const;
+	                                zeek::IntrusivePtr<RecordVal> args) const;
 
 	/**
 	 * Create an instance of a file analyzer.
@@ -120,7 +120,7 @@ protected:
 	 * @return a new file analyzer instance.
 	 */
 	file_analysis::Analyzer* InstantiateAnalyzer(const file_analysis::Tag& tag,
-	                                             IntrusivePtr<RecordVal> args) const;
+	                                             zeek::IntrusivePtr<RecordVal> args) const;
 
 	/**
 	 * Insert an analyzer instance in to the set.
diff --git a/src/file_analysis/Component.h b/src/file_analysis/Component.h
index 98ac262127..7476f26d61 100644
--- a/src/file_analysis/Component.h
+++ b/src/file_analysis/Component.h
@@ -26,7 +26,7 @@ class Component : public zeek::plugin::Component,
                   public plugin::TaggedComponent<file_analysis::Tag> {
 public:
 	typedef Analyzer* (*factory_callback)(RecordVal* args, File* file);
-	using factory_function = Analyzer* (*)(IntrusivePtr<RecordVal> args, File* file);
+	using factory_function = Analyzer* (*)(zeek::IntrusivePtr<RecordVal> args, File* file);
 
 	/**
 	 * Constructor.
diff --git a/src/file_analysis/File.cc b/src/file_analysis/File.cc
index 2b97a746c6..4f62c3fc5a 100644
--- a/src/file_analysis/File.cc
+++ b/src/file_analysis/File.cc
@@ -21,21 +21,21 @@
 
 using namespace file_analysis;
 
-static IntrusivePtr<TableVal> empty_connection_table()
+static zeek::IntrusivePtr<TableVal> empty_connection_table()
 	{
-	auto tbl_index = make_intrusive<zeek::TypeList>(zeek::id::conn_id);
+	auto tbl_index = zeek::make_intrusive<zeek::TypeList>(zeek::id::conn_id);
 	tbl_index->Append(zeek::id::conn_id);
-	auto tbl_type = make_intrusive<zeek::TableType>(std::move(tbl_index),
+	auto tbl_type = zeek::make_intrusive<zeek::TableType>(std::move(tbl_index),
 	                                                        zeek::id::connection);
-	return make_intrusive<TableVal>(std::move(tbl_type));
+	return zeek::make_intrusive<TableVal>(std::move(tbl_type));
 	}
 
-static IntrusivePtr<RecordVal> get_conn_id_val(const Connection* conn)
+static zeek::IntrusivePtr<RecordVal> get_conn_id_val(const Connection* conn)
 	{
-	auto v = make_intrusive<RecordVal>(zeek::id::conn_id);
-	v->Assign(0, make_intrusive<AddrVal>(conn->OrigAddr()));
+	auto v = zeek::make_intrusive<RecordVal>(zeek::id::conn_id);
+	v->Assign(0, zeek::make_intrusive<AddrVal>(conn->OrigAddr()));
 	v->Assign(1, val_mgr->Port(ntohs(conn->OrigPort()), conn->ConnTransport()));
-	v->Assign(2, make_intrusive<AddrVal>(conn->RespAddr()));
+	v->Assign(2, zeek::make_intrusive<AddrVal>(conn->RespAddr()));
 	v->Assign(3, val_mgr->Port(ntohs(conn->RespPort()), conn->ConnTransport()));
 	return v;
 	}
@@ -91,8 +91,8 @@ File::File(const std::string& file_id, const std::string& source_name, Connectio
 
 	DBG_LOG(DBG_FILE_ANALYSIS, "[%s] Creating new File object", file_id.c_str());
 
-	val = make_intrusive<RecordVal>(zeek::id::fa_file);
-	val->Assign(id_idx, make_intrusive<StringVal>(file_id.c_str()));
+	val = zeek::make_intrusive<RecordVal>(zeek::id::fa_file);
+	val->Assign(id_idx, zeek::make_intrusive<StringVal>(file_id.c_str()));
 	SetSource(source_name);
 
 	if ( conn )
@@ -115,7 +115,7 @@ File::~File()
 
 void File::UpdateLastActivityTime()
 	{
-	val->Assign(last_active_idx, make_intrusive<TimeVal>(network_time));
+	val->Assign(last_active_idx, zeek::make_intrusive<TimeVal>(network_time));
 	}
 
 double File::GetLastActivityTime() const
@@ -190,7 +190,7 @@ std::string File::GetSource() const
 
 void File::SetSource(const std::string& source)
 	{
-	val->Assign(source_idx, make_intrusive<StringVal>(source.c_str()));
+	val->Assign(source_idx, zeek::make_intrusive<StringVal>(source.c_str()));
 	}
 
 double File::GetTimeoutInterval() const
@@ -200,13 +200,13 @@ double File::GetTimeoutInterval() const
 
 void File::SetTimeoutInterval(double interval)
 	{
-	val->Assign(timeout_interval_idx, make_intrusive<IntervalVal>(interval));
+	val->Assign(timeout_interval_idx, zeek::make_intrusive<IntervalVal>(interval));
 	}
 
 bool File::SetExtractionLimit(RecordVal* args, uint64_t bytes)
-	{ return SetExtractionLimit({NewRef{}, args}, bytes); }
+	{ return SetExtractionLimit({zeek::NewRef{}, args}, bytes); }
 
-bool File::SetExtractionLimit(IntrusivePtr<RecordVal> args, uint64_t bytes)
+bool File::SetExtractionLimit(zeek::IntrusivePtr<RecordVal> args, uint64_t bytes)
 	{
 	Analyzer* a = analyzers.Find(file_mgr->GetComponentTag("EXTRACT"),
 	                             std::move(args));
@@ -254,9 +254,9 @@ void File::ScheduleInactivityTimer() const
 	}
 
 bool File::AddAnalyzer(file_analysis::Tag tag, RecordVal* args)
-	{ return AddAnalyzer(tag, {NewRef{}, args}); }
+	{ return AddAnalyzer(tag, {zeek::NewRef{}, args}); }
 
-bool File::AddAnalyzer(file_analysis::Tag tag, IntrusivePtr<RecordVal> args)
+bool File::AddAnalyzer(file_analysis::Tag tag, zeek::IntrusivePtr<RecordVal> args)
 	{
 	DBG_LOG(DBG_FILE_ANALYSIS, "[%s] Queuing addition of %s analyzer",
 		id.c_str(), file_mgr->GetComponentName(tag).c_str());
@@ -268,9 +268,9 @@ bool File::AddAnalyzer(file_analysis::Tag tag, IntrusivePtr<RecordVal> args)
 	}
 
 bool File::RemoveAnalyzer(file_analysis::Tag tag, RecordVal* args)
-	{ return RemoveAnalyzer(tag, {NewRef{}, args}); }
+	{ return RemoveAnalyzer(tag, {zeek::NewRef{}, args}); }
 
-bool File::RemoveAnalyzer(file_analysis::Tag tag, IntrusivePtr<RecordVal> args)
+bool File::RemoveAnalyzer(file_analysis::Tag tag, zeek::IntrusivePtr<RecordVal> args)
 	{
 	DBG_LOG(DBG_FILE_ANALYSIS, "[%s] Queuing remove of %s analyzer",
 		id.c_str(), file_mgr->GetComponentName(tag).c_str());
@@ -306,8 +306,8 @@ bool File::SetMime(const std::string& mime_type)
 	if ( ! FileEventAvailable(file_sniff) )
 		return false;
 
-	auto meta = make_intrusive<RecordVal>(zeek::id::fa_metadata);
-	meta->Assign(meta_mime_type_idx, make_intrusive<StringVal>(mime_type));
+	auto meta = zeek::make_intrusive<RecordVal>(zeek::id::fa_metadata);
+	meta->Assign(meta_mime_type_idx, zeek::make_intrusive<StringVal>(mime_type));
 	meta->Assign(meta_inferred_idx, val_mgr->False());
 
 	FileEvent(file_sniff, {val, std::move(meta)});
@@ -339,7 +339,7 @@ void File::InferMetadata()
 	len = std::min(len, LookupFieldDefaultCount(bof_buffer_size_idx));
 	file_mgr->DetectMIME(data, len, &matches);
 
-	auto meta = make_intrusive<RecordVal>(zeek::id::fa_metadata);
+	auto meta = zeek::make_intrusive<RecordVal>(zeek::id::fa_metadata);
 
 	if ( ! matches.empty() )
 		{
@@ -370,7 +370,7 @@ bool File::BufferBOF(const u_char* data, uint64_t len)
 	if ( bof_buffer.size > 0 )
 		{
 		BroString* bs = concatenate(bof_buffer.chunks);
-		val->Assign(bof_buffer_idx, make_intrusive<StringVal>(bs));
+		val->Assign(bof_buffer_idx, zeek::make_intrusive<StringVal>(bs));
 		}
 
 	return false;
diff --git a/src/file_analysis/File.h b/src/file_analysis/File.h
index 0eacf90a6b..628a5f2d69 100644
--- a/src/file_analysis/File.h
+++ b/src/file_analysis/File.h
@@ -39,7 +39,7 @@ public:
 	/**
 	 * @return the wrapped \c fa_file record value, #val.
 	 */
-	const IntrusivePtr<RecordVal>& ToVal() const
+	const zeek::IntrusivePtr<RecordVal>& ToVal() const
 		{ return val; }
 
 	[[deprecated("Remove in v4.1.  Use ToVal().")]]
@@ -75,7 +75,7 @@ public:
 	 * @param bytes new limit.
 	 * @return false if no extraction analyzer is active, else true.
 	 */
-	bool SetExtractionLimit(IntrusivePtr<RecordVal> args, uint64_t bytes);
+	bool SetExtractionLimit(zeek::IntrusivePtr<RecordVal> args, uint64_t bytes);
 
 	[[deprecated("Remove in v4.1.  Pass an IntrusivePtr instead.")]]
 	bool SetExtractionLimit(RecordVal* args, uint64_t bytes);
@@ -123,7 +123,7 @@ public:
 	 * @param args an \c AnalyzerArgs value representing a file analyzer.
 	 * @return false if analyzer can't be instantiated, else true.
 	 */
-	bool AddAnalyzer(file_analysis::Tag tag, IntrusivePtr<RecordVal> args);
+	bool AddAnalyzer(file_analysis::Tag tag, zeek::IntrusivePtr<RecordVal> args);
 
 	[[deprecated("Remove in v4.1.  Pass an IntrusivePtr instead.")]]
 	bool AddAnalyzer(file_analysis::Tag tag, RecordVal* args);
@@ -134,7 +134,7 @@ public:
 	 * @param args an \c AnalyzerArgs value representing a file analyzer.
 	 * @return true if analyzer was active at time of call, else false.
 	 */
-	bool RemoveAnalyzer(file_analysis::Tag tag, IntrusivePtr<RecordVal> args);
+	bool RemoveAnalyzer(file_analysis::Tag tag, zeek::IntrusivePtr<RecordVal> args);
 
 	[[deprecated("Remove in v4.1.  Pass an IntrusivePtr instead.")]]
 	bool RemoveAnalyzer(file_analysis::Tag tag, RecordVal* args);
@@ -338,7 +338,7 @@ protected:
 	 * @return the field offset in #val record corresponding to \a field_name.
 	 */
 	static int Idx(const std::string& field_name, const zeek::RecordType* type);
-	static int Idx(const std::string& field_name, const IntrusivePtr<zeek::RecordType>& type)
+	static int Idx(const std::string& field_name, const zeek::IntrusivePtr<zeek::RecordType>& type)
 		{ return Idx(field_name, type.get()); }
 
 	/**
@@ -348,7 +348,7 @@ protected:
 
 protected:
 	std::string id;                 /**< A pretty hash that likely identifies file */
-	IntrusivePtr<RecordVal> val;            /**< \c fa_file from script layer. */
+	zeek::IntrusivePtr<RecordVal> val;            /**< \c fa_file from script layer. */
 	FileReassembler* file_reassembler; /**< A reassembler for the file if it's needed. */
 	uint64_t stream_offset;      /**< The offset of the file which has been forwarded. */
 	uint64_t reassembly_max_buffer;      /**< Maximum allowed buffer for reassembly. */
diff --git a/src/file_analysis/Manager.cc b/src/file_analysis/Manager.cc
index c2c734e7c6..9b79cfdf0d 100644
--- a/src/file_analysis/Manager.cc
+++ b/src/file_analysis/Manager.cc
@@ -260,10 +260,10 @@ bool Manager::SetReassemblyBuffer(const string& file_id, uint64_t max)
 
 bool Manager::SetExtractionLimit(const string& file_id, RecordVal* args,
                                  uint64_t n) const
-	{ return SetExtractionLimit(file_id, {NewRef{}, args}, n); }
+	{ return SetExtractionLimit(file_id, {zeek::NewRef{}, args}, n); }
 
 bool Manager::SetExtractionLimit(const string& file_id,
-                                 IntrusivePtr<RecordVal> args, uint64_t n) const
+                                 zeek::IntrusivePtr<RecordVal> args, uint64_t n) const
 	{
 	File* file = LookupFile(file_id);
 
@@ -275,10 +275,10 @@ bool Manager::SetExtractionLimit(const string& file_id,
 
 bool Manager::AddAnalyzer(const string& file_id, const file_analysis::Tag& tag,
                           RecordVal* args) const
-	{ return AddAnalyzer(file_id, tag, {NewRef{}, args}); }
+	{ return AddAnalyzer(file_id, tag, {zeek::NewRef{}, args}); }
 
 bool Manager::AddAnalyzer(const string& file_id, const file_analysis::Tag& tag,
-                          IntrusivePtr<RecordVal> args) const
+                          zeek::IntrusivePtr<RecordVal> args) const
 	{
 	File* file = LookupFile(file_id);
 
@@ -290,10 +290,10 @@ bool Manager::AddAnalyzer(const string& file_id, const file_analysis::Tag& tag,
 
 bool Manager::RemoveAnalyzer(const string& file_id, const file_analysis::Tag& tag,
                              RecordVal* args) const
-	{ return RemoveAnalyzer(file_id, tag, {NewRef{}, args}); }
+	{ return RemoveAnalyzer(file_id, tag, {zeek::NewRef{}, args}); }
 
 bool Manager::RemoveAnalyzer(const string& file_id, const file_analysis::Tag& tag,
-                             IntrusivePtr<RecordVal> args) const
+                             zeek::IntrusivePtr<RecordVal> args) const
 	{
 	File* file = LookupFile(file_id);
 
@@ -455,10 +455,10 @@ bool Manager::IsDisabled(const analyzer::Tag& tag)
 	}
 
 Analyzer* Manager::InstantiateAnalyzer(const Tag& tag, RecordVal* args, File* f) const
-	{ return InstantiateAnalyzer(tag, {NewRef{}, args}, f); }
+	{ return InstantiateAnalyzer(tag, {zeek::NewRef{}, args}, f); }
 
 Analyzer* Manager::InstantiateAnalyzer(const Tag& tag,
-                                       IntrusivePtr<RecordVal> args,
+                                       zeek::IntrusivePtr<RecordVal> args,
                                        File* f) const
 	{
 	Component* c = Lookup(tag);
@@ -517,22 +517,22 @@ string Manager::DetectMIME(const u_char* data, uint64_t len) const
 	return *(matches.begin()->second.begin());
 	}
 
-IntrusivePtr<VectorVal> file_analysis::GenMIMEMatchesVal(const RuleMatcher::MIME_Matches& m)
+zeek::IntrusivePtr<VectorVal> file_analysis::GenMIMEMatchesVal(const RuleMatcher::MIME_Matches& m)
 	{
 	static auto mime_matches = zeek::id::find_type<zeek::VectorType>("mime_matches");
 	static auto mime_match = zeek::id::find_type<zeek::RecordType>("mime_match");
-	auto rval = make_intrusive<VectorVal>(mime_matches);
+	auto rval = zeek::make_intrusive<VectorVal>(mime_matches);
 
 	for ( RuleMatcher::MIME_Matches::const_iterator it = m.begin();
 	      it != m.end(); ++it )
 		{
-		auto element = make_intrusive<RecordVal>(mime_match);
+		auto element = zeek::make_intrusive<RecordVal>(mime_match);
 
 		for ( set<string>::const_iterator it2 = it->second.begin();
 		      it2 != it->second.end(); ++it2 )
 			{
 			element->Assign(0, val_mgr->Int(it->first));
-			element->Assign(1, make_intrusive<StringVal>(*it2));
+			element->Assign(1, zeek::make_intrusive<StringVal>(*it2));
 			}
 
 		rval->Assign(rval->Size(), std::move(element));
diff --git a/src/file_analysis/Manager.h b/src/file_analysis/Manager.h
index 6a233192e9..03cdabfc1e 100644
--- a/src/file_analysis/Manager.h
+++ b/src/file_analysis/Manager.h
@@ -254,7 +254,7 @@ public:
 	 *         else true.
 	 */
 	bool SetExtractionLimit(const std::string& file_id,
-	                        IntrusivePtr<RecordVal> args, uint64_t n) const;
+	                        zeek::IntrusivePtr<RecordVal> args, uint64_t n) const;
 
 	[[deprecated("Remove in v4.1.  Pass IntrusivePtr args param instead.")]]
 	bool SetExtractionLimit(const std::string& file_id, RecordVal* args,
@@ -278,7 +278,7 @@ public:
 	 * @return false if the analyzer failed to be instantiated, else true.
 	 */
 	bool AddAnalyzer(const std::string& file_id, const file_analysis::Tag& tag,
-	                 IntrusivePtr<RecordVal> args) const;
+	                 zeek::IntrusivePtr<RecordVal> args) const;
 
 	[[deprecated("Remove in v4.1.  Pass IntrusivePtr args param instead.")]]
 	bool AddAnalyzer(const std::string& file_id, const file_analysis::Tag& tag,
@@ -292,7 +292,7 @@ public:
 	 * @return true if the analyzer is active at the time of call, else false.
 	 */
 	bool RemoveAnalyzer(const std::string& file_id, const file_analysis::Tag& tag,
-	                    IntrusivePtr<RecordVal> args) const;
+	                    zeek::IntrusivePtr<RecordVal> args) const;
 
 	[[deprecated("Remove in v4.1.  Pass IntrusivePtr args param instead.")]]
 	bool RemoveAnalyzer(const std::string& file_id, const file_analysis::Tag& tag,
@@ -312,7 +312,7 @@ public:
 	 * @param f The file analzer is to be associated with.
 	 * @return The new analyzer instance or null if tag is invalid.
 	 */
-	Analyzer* InstantiateAnalyzer(const Tag& tag, IntrusivePtr<RecordVal> args,
+	Analyzer* InstantiateAnalyzer(const Tag& tag, zeek::IntrusivePtr<RecordVal> args,
 	                              File* f) const;
 
 	[[deprecated("Remove in v4.1.  Pass in IntrusivePtr args instead.")]]
@@ -438,7 +438,7 @@ private:
  * Returns a script-layer value corresponding to the \c mime_matches type.
  * @param m The MIME match information with which to populate the value.
  */
-IntrusivePtr<VectorVal> GenMIMEMatchesVal(const RuleMatcher::MIME_Matches& m);
+zeek::IntrusivePtr<VectorVal> GenMIMEMatchesVal(const RuleMatcher::MIME_Matches& m);
 
 } // namespace file_analysis
 
diff --git a/src/file_analysis/Tag.cc b/src/file_analysis/Tag.cc
index 1789600f26..eb7d62fee0 100644
--- a/src/file_analysis/Tag.cc
+++ b/src/file_analysis/Tag.cc
@@ -18,7 +18,7 @@ file_analysis::Tag& file_analysis::Tag::operator=(const file_analysis::Tag& othe
 	return *this;
 	}
 
-const IntrusivePtr<EnumVal>& file_analysis::Tag::AsVal() const
+const zeek::IntrusivePtr<EnumVal>& file_analysis::Tag::AsVal() const
 	{
 	return ::Tag::AsVal(file_mgr->GetTagType());
 	}
@@ -28,10 +28,10 @@ EnumVal* file_analysis::Tag::AsEnumVal() const
 	return AsVal().get();
 	}
 
-file_analysis::Tag::Tag(IntrusivePtr<EnumVal> val)
+file_analysis::Tag::Tag(zeek::IntrusivePtr<EnumVal> val)
 	: ::Tag(std::move(val))
 	{ }
 
 file_analysis::Tag::Tag(EnumVal* val)
-	: ::Tag({NewRef{}, val})
+	: ::Tag({zeek::NewRef{}, val})
 	{ }
diff --git a/src/file_analysis/Tag.h b/src/file_analysis/Tag.h
index e2a1e1a1d8..1f5e22c882 100644
--- a/src/file_analysis/Tag.h
+++ b/src/file_analysis/Tag.h
@@ -88,7 +88,7 @@ public:
 	 *
 	 * @param etype the script-layer enum type associated with the tag.
 	 */
-	const IntrusivePtr<EnumVal>& AsVal() const;
+	const zeek::IntrusivePtr<EnumVal>& AsVal() const;
 
 	[[deprecated("Remove in v4.1.  Use AsVal() instead.")]]
 	EnumVal* AsEnumVal() const;
@@ -116,7 +116,7 @@ protected:
 	 *
 	 * @param val An enum value of script type \c Files::Tag.
 	 */
-	explicit Tag(IntrusivePtr<EnumVal> val);
+	explicit Tag(zeek::IntrusivePtr<EnumVal> val);
 
 	[[deprecated("Remove in v4.1.  Construct from IntrusivePtr instead.")]]
 	explicit Tag(EnumVal* val);
diff --git a/src/file_analysis/analyzer/data_event/DataEvent.cc b/src/file_analysis/analyzer/data_event/DataEvent.cc
index 04175723af..4fd09744ff 100644
--- a/src/file_analysis/analyzer/data_event/DataEvent.cc
+++ b/src/file_analysis/analyzer/data_event/DataEvent.cc
@@ -11,7 +11,7 @@
 
 using namespace file_analysis;
 
-DataEvent::DataEvent(IntrusivePtr<RecordVal> args, File* file,
+DataEvent::DataEvent(zeek::IntrusivePtr<RecordVal> args, File* file,
                      EventHandlerPtr ce, EventHandlerPtr se)
     : file_analysis::Analyzer(file_mgr->GetComponentTag("DATA_EVENT"),
 	                          std::move(args), file),
@@ -19,7 +19,7 @@ DataEvent::DataEvent(IntrusivePtr<RecordVal> args, File* file,
 	{
 	}
 
-file_analysis::Analyzer* DataEvent::Instantiate(IntrusivePtr<RecordVal> args,
+file_analysis::Analyzer* DataEvent::Instantiate(zeek::IntrusivePtr<RecordVal> args,
                                                 File* file)
 	{
 	const auto& chunk_val = args->GetField("chunk_event");
@@ -45,7 +45,7 @@ bool DataEvent::DeliverChunk(const u_char* data, uint64_t len, uint64_t offset)
 
 	mgr.Enqueue(chunk_event,
 		GetFile()->ToVal(),
-		make_intrusive<StringVal>(new BroString(data, len, false)),
+		zeek::make_intrusive<StringVal>(new BroString(data, len, false)),
 		val_mgr->Count(offset)
 	);
 
@@ -58,7 +58,7 @@ bool DataEvent::DeliverStream(const u_char* data, uint64_t len)
 
 	mgr.Enqueue(stream_event,
 		GetFile()->ToVal(),
-		make_intrusive<StringVal>(new BroString(data, len, false))
+		zeek::make_intrusive<StringVal>(new BroString(data, len, false))
 	);
 
 	return true;
diff --git a/src/file_analysis/analyzer/data_event/DataEvent.h b/src/file_analysis/analyzer/data_event/DataEvent.h
index c1dd1ab64b..5290925f80 100644
--- a/src/file_analysis/analyzer/data_event/DataEvent.h
+++ b/src/file_analysis/analyzer/data_event/DataEvent.h
@@ -43,7 +43,7 @@ public:
 	 * @return the new DataEvent analyzer instance or a null pointer if
 	 *         no "chunk_event" or "stream_event" field was specfied in \a args.
 	 */
-	static file_analysis::Analyzer* Instantiate(IntrusivePtr<RecordVal> args,
+	static file_analysis::Analyzer* Instantiate(zeek::IntrusivePtr<RecordVal> args,
 	                                            File* file);
 
 protected:
@@ -57,7 +57,7 @@ protected:
 	 * @param se pointer to event handler which will be called to receive
 	 *        sequential file data.
 	 */
-	DataEvent(IntrusivePtr<RecordVal> args, File* file,
+	DataEvent(zeek::IntrusivePtr<RecordVal> args, File* file,
 	          EventHandlerPtr ce, EventHandlerPtr se);
 
 private:
diff --git a/src/file_analysis/analyzer/entropy/Entropy.cc b/src/file_analysis/analyzer/entropy/Entropy.cc
index 93d92eefee..21a445b78e 100644
--- a/src/file_analysis/analyzer/entropy/Entropy.cc
+++ b/src/file_analysis/analyzer/entropy/Entropy.cc
@@ -9,7 +9,7 @@
 
 using namespace file_analysis;
 
-Entropy::Entropy(IntrusivePtr<RecordVal> args, File* file)
+Entropy::Entropy(zeek::IntrusivePtr<RecordVal> args, File* file)
     : file_analysis::Analyzer(file_mgr->GetComponentTag("ENTROPY"),
                               std::move(args), file)
 	{
@@ -23,7 +23,7 @@ Entropy::~Entropy()
 	Unref(entropy);
 	}
 
-file_analysis::Analyzer* Entropy::Instantiate(IntrusivePtr<RecordVal> args,
+file_analysis::Analyzer* Entropy::Instantiate(zeek::IntrusivePtr<RecordVal> args,
                                               File* file)
 	{
 	return new Entropy(std::move(args), file);
@@ -63,7 +63,7 @@ void Entropy::Finalize()
 	entropy->Get(&ent, &chisq, &mean, &montepi, &scc);
 
 	static auto entropy_test_result = zeek::id::find_type<zeek::RecordType>("entropy_test_result");
-	auto ent_result = make_intrusive<RecordVal>(entropy_test_result);
+	auto ent_result = zeek::make_intrusive<RecordVal>(entropy_test_result);
 	ent_result->Assign<DoubleVal>(0, ent);
 	ent_result->Assign<DoubleVal>(1, chisq);
 	ent_result->Assign<DoubleVal>(2, mean);
diff --git a/src/file_analysis/analyzer/entropy/Entropy.h b/src/file_analysis/analyzer/entropy/Entropy.h
index 2f65f1aa56..1b5634d520 100644
--- a/src/file_analysis/analyzer/entropy/Entropy.h
+++ b/src/file_analysis/analyzer/entropy/Entropy.h
@@ -31,7 +31,7 @@ public:
 	 * @return the new Entropy analyzer instance or a null pointer if the
 	 *         the "extraction_file" field of \a args wasn't set.
 	 */
-	static file_analysis::Analyzer* Instantiate(IntrusivePtr<RecordVal> args,
+	static file_analysis::Analyzer* Instantiate(zeek::IntrusivePtr<RecordVal> args,
 	                                            File* file);
 
 	/**
@@ -66,7 +66,7 @@ protected:
 	 * @param hv specific hash calculator object.
 	 * @param kind human readable name of the hash algorithm to use.
 	 */
-	Entropy(IntrusivePtr<RecordVal> args, File* file);
+	Entropy(zeek::IntrusivePtr<RecordVal> args, File* file);
 
 	/**
 	 * If some file contents have been seen, finalizes the entropy of them and
diff --git a/src/file_analysis/analyzer/extract/Extract.cc b/src/file_analysis/analyzer/extract/Extract.cc
index 869c8e8724..c20f10097d 100644
--- a/src/file_analysis/analyzer/extract/Extract.cc
+++ b/src/file_analysis/analyzer/extract/Extract.cc
@@ -10,7 +10,7 @@
 
 using namespace file_analysis;
 
-Extract::Extract(IntrusivePtr<RecordVal> args, File* file,
+Extract::Extract(zeek::IntrusivePtr<RecordVal> args, File* file,
                  const std::string& arg_filename, uint64_t arg_limit)
     : file_analysis::Analyzer(file_mgr->GetComponentTag("EXTRACT"),
                               std::move(args), file),
@@ -33,8 +33,8 @@ Extract::~Extract()
 		safe_close(fd);
 	}
 
-static const IntrusivePtr<Val>& get_extract_field_val(const IntrusivePtr<RecordVal>& args,
-                                                      const char* name)
+static const zeek::IntrusivePtr<Val>& get_extract_field_val(const zeek::IntrusivePtr<RecordVal>& args,
+                                                            const char* name)
 	{
 	const auto& rval = args->GetField(name);
 
@@ -44,7 +44,7 @@ static const IntrusivePtr<Val>& get_extract_field_val(const IntrusivePtr<RecordV
 	return rval;
 	}
 
-file_analysis::Analyzer* Extract::Instantiate(IntrusivePtr<RecordVal> args, File* file)
+file_analysis::Analyzer* Extract::Instantiate(zeek::IntrusivePtr<RecordVal> args, File* file)
 	{
 	const auto& fname = get_extract_field_val(args, "extract_filename");
 	const auto& limit = get_extract_field_val(args, "extract_limit");
diff --git a/src/file_analysis/analyzer/extract/Extract.h b/src/file_analysis/analyzer/extract/Extract.h
index c51e2e1a80..d8aa58205e 100644
--- a/src/file_analysis/analyzer/extract/Extract.h
+++ b/src/file_analysis/analyzer/extract/Extract.h
@@ -47,7 +47,7 @@ public:
 	 * @return the new Extract analyzer instance or a null pointer if the
 	 *         the "extraction_file" field of \a args wasn't set.
 	 */
-	static file_analysis::Analyzer* Instantiate(IntrusivePtr<RecordVal> args,
+	static file_analysis::Analyzer* Instantiate(zeek::IntrusivePtr<RecordVal> args,
 	                                            File* file);
 
 	/**
@@ -67,7 +67,7 @@ protected:
 	 *        to which the contents of the file will be extracted/written.
 	 * @param arg_limit the maximum allowed file size.
 	 */
-	Extract(IntrusivePtr<RecordVal> args, File* file,
+	Extract(zeek::IntrusivePtr<RecordVal> args, File* file,
 	        const std::string& arg_filename, uint64_t arg_limit);
 
 private:
diff --git a/src/file_analysis/analyzer/hash/Hash.cc b/src/file_analysis/analyzer/hash/Hash.cc
index 011b6ef443..bde87188df 100644
--- a/src/file_analysis/analyzer/hash/Hash.cc
+++ b/src/file_analysis/analyzer/hash/Hash.cc
@@ -9,7 +9,7 @@
 
 using namespace file_analysis;
 
-Hash::Hash(IntrusivePtr<RecordVal> args, File* file, HashVal* hv, const char* arg_kind)
+Hash::Hash(zeek::IntrusivePtr<RecordVal> args, File* file, HashVal* hv, const char* arg_kind)
 	: file_analysis::Analyzer(file_mgr->GetComponentTag(to_upper(arg_kind).c_str()),
 	                          std::move(args), file),
 	  hash(hv), fed(false), kind(arg_kind)
@@ -55,7 +55,7 @@ void Hash::Finalize()
 
 	mgr.Enqueue(file_hash,
 		GetFile()->ToVal(),
-		make_intrusive<StringVal>(kind),
+		zeek::make_intrusive<StringVal>(kind),
 		hash->Get()
 	);
 	}
diff --git a/src/file_analysis/analyzer/hash/Hash.h b/src/file_analysis/analyzer/hash/Hash.h
index 190152d1c3..042d720338 100644
--- a/src/file_analysis/analyzer/hash/Hash.h
+++ b/src/file_analysis/analyzer/hash/Hash.h
@@ -56,7 +56,7 @@ protected:
 	 * @param hv specific hash calculator object.
 	 * @param kind human readable name of the hash algorithm to use.
 	 */
-	Hash(IntrusivePtr<RecordVal> args, File* file, HashVal* hv, const char* kind);
+	Hash(zeek::IntrusivePtr<RecordVal> args, File* file, HashVal* hv, const char* kind);
 
 	/**
 	 * If some file contents have been seen, finalizes the hash of them and
@@ -83,7 +83,7 @@ public:
 	 * @return the new MD5 analyzer instance or a null pointer if there's no
 	 *         handler for the "file_hash" event.
 	 */
-	static file_analysis::Analyzer* Instantiate(IntrusivePtr<RecordVal> args,
+	static file_analysis::Analyzer* Instantiate(zeek::IntrusivePtr<RecordVal> args,
 	                                            File* file)
 		{ return file_hash ? new MD5(std::move(args), file) : nullptr; }
 
@@ -94,7 +94,7 @@ protected:
 	 * @param args the \c AnalyzerArgs value which represents the analyzer.
 	 * @param file the file to which the analyzer will be attached.
 	 */
-	MD5(IntrusivePtr<RecordVal> args, File* file)
+	MD5(zeek::IntrusivePtr<RecordVal> args, File* file)
 		: Hash(std::move(args), file, new MD5Val(), "md5")
 		{}
 };
@@ -112,7 +112,7 @@ public:
 	 * @return the new MD5 analyzer instance or a null pointer if there's no
 	 *         handler for the "file_hash" event.
 	 */
-	static file_analysis::Analyzer* Instantiate(IntrusivePtr<RecordVal> args,
+	static file_analysis::Analyzer* Instantiate(zeek::IntrusivePtr<RecordVal> args,
 	                                            File* file)
 		{ return file_hash ? new SHA1(std::move(args), file) : nullptr; }
 
@@ -123,7 +123,7 @@ protected:
 	 * @param args the \c AnalyzerArgs value which represents the analyzer.
 	 * @param file the file to which the analyzer will be attached.
 	 */
-	SHA1(IntrusivePtr<RecordVal> args, File* file)
+	SHA1(zeek::IntrusivePtr<RecordVal> args, File* file)
 		: Hash(std::move(args), file, new SHA1Val(), "sha1")
 		{}
 };
@@ -141,7 +141,7 @@ public:
 	 * @return the new MD5 analyzer instance or a null pointer if there's no
 	 *         handler for the "file_hash" event.
 	 */
-	static file_analysis::Analyzer* Instantiate(IntrusivePtr<RecordVal> args,
+	static file_analysis::Analyzer* Instantiate(zeek::IntrusivePtr<RecordVal> args,
 	                                            File* file)
 		{ return file_hash ? new SHA256(std::move(args), file) : nullptr; }
 
@@ -152,7 +152,7 @@ protected:
 	 * @param args the \c AnalyzerArgs value which represents the analyzer.
 	 * @param file the file to which the analyzer will be attached.
 	 */
-	SHA256(IntrusivePtr<RecordVal> args, File* file)
+	SHA256(zeek::IntrusivePtr<RecordVal> args, File* file)
 		: Hash(std::move(args), file, new SHA256Val(), "sha256")
 		{}
 };
diff --git a/src/file_analysis/analyzer/pe/PE.cc b/src/file_analysis/analyzer/pe/PE.cc
index 0962f51dfa..695be58ff4 100644
--- a/src/file_analysis/analyzer/pe/PE.cc
+++ b/src/file_analysis/analyzer/pe/PE.cc
@@ -3,7 +3,7 @@
 
 using namespace file_analysis;
 
-PE::PE(IntrusivePtr<RecordVal> args, File* file)
+PE::PE(zeek::IntrusivePtr<RecordVal> args, File* file)
     : file_analysis::Analyzer(file_mgr->GetComponentTag("PE"), std::move(args),
                               file)
 	{
diff --git a/src/file_analysis/analyzer/pe/PE.h b/src/file_analysis/analyzer/pe/PE.h
index 87a82825f4..44bdc5567e 100644
--- a/src/file_analysis/analyzer/pe/PE.h
+++ b/src/file_analysis/analyzer/pe/PE.h
@@ -15,7 +15,7 @@ class PE : public file_analysis::Analyzer {
 public:
 	~PE();
 
-	static file_analysis::Analyzer* Instantiate(IntrusivePtr<RecordVal> args,
+	static file_analysis::Analyzer* Instantiate(zeek::IntrusivePtr<RecordVal> args,
 	                                            File* file)
 		{ return new PE(std::move(args), file); }
 
@@ -24,7 +24,7 @@ public:
 	virtual bool EndOfFile();
 
 protected:
-	PE(IntrusivePtr<RecordVal> args, File* file);
+	PE(zeek::IntrusivePtr<RecordVal> args, File* file);
 	binpac::PE::File* interp;
 	binpac::PE::MockConnection* conn;
 	bool done;
diff --git a/src/file_analysis/analyzer/pe/pe-analyzer.pac b/src/file_analysis/analyzer/pe/pe-analyzer.pac
index ce34f015e6..52cd3b609a 100644
--- a/src/file_analysis/analyzer/pe/pe-analyzer.pac
+++ b/src/file_analysis/analyzer/pe/pe-analyzer.pac
@@ -5,14 +5,14 @@
 %}
 
 %header{
-IntrusivePtr<VectorVal> process_rvas(const RVAS* rvas);
-IntrusivePtr<TableVal> characteristics_to_bro(uint32_t c, uint8_t len);
+zeek::IntrusivePtr<VectorVal> process_rvas(const RVAS* rvas);
+zeek::IntrusivePtr<TableVal> characteristics_to_bro(uint32_t c, uint8_t len);
 %}
 
 %code{
-IntrusivePtr<VectorVal> process_rvas(const RVAS* rva_table)
+zeek::IntrusivePtr<VectorVal> process_rvas(const RVAS* rva_table)
 	{
-	auto rvas = make_intrusive<VectorVal>(zeek::id::index_vec);
+	auto rvas = zeek::make_intrusive<VectorVal>(zeek::id::index_vec);
 
 	for ( uint16 i=0; i < rva_table->rvas()->size(); ++i )
 		rvas->Assign(i, val_mgr->Count((*rva_table->rvas())[i]->size()));
@@ -20,10 +20,10 @@ IntrusivePtr<VectorVal> process_rvas(const RVAS* rva_table)
 	return rvas;
 	}
 
-IntrusivePtr<TableVal> characteristics_to_bro(uint32_t c, uint8_t len)
+zeek::IntrusivePtr<TableVal> characteristics_to_bro(uint32_t c, uint8_t len)
 	{
 	uint64 mask = (len==16) ? 0xFFFF : 0xFFFFFFFF;
-	auto char_set = make_intrusive<TableVal>(zeek::id::count_set);
+	auto char_set = zeek::make_intrusive<TableVal>(zeek::id::count_set);
 
 	for ( uint16 i=0; i < len; ++i )
 		{
@@ -46,8 +46,8 @@ refine flow File += {
 		%{
 		if ( pe_dos_header )
 			{
-			auto dh = make_intrusive<RecordVal>(zeek::BifType::Record::PE::DOSHeader);
-			dh->Assign(0, make_intrusive<StringVal>(${h.signature}.length(), (const char*) ${h.signature}.data()));
+			auto dh = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::PE::DOSHeader);
+			dh->Assign(0, zeek::make_intrusive<StringVal>(${h.signature}.length(), (const char*) ${h.signature}.data()));
 			dh->Assign(1, val_mgr->Count(${h.UsedBytesInTheLastPage}));
 			dh->Assign(2, val_mgr->Count(${h.FileSizeInPages}));
 			dh->Assign(3, val_mgr->Count(${h.NumberOfRelocationItems}));
@@ -77,7 +77,7 @@ refine flow File += {
 		if ( pe_dos_code )
 			mgr.Enqueue(pe_dos_code,
 			    connection()->bro_analyzer()->GetFile()->ToVal(),
-			    make_intrusive<StringVal>(code.length(), (const char*) code.data())
+			    zeek::make_intrusive<StringVal>(code.length(), (const char*) code.data())
 			    );
 		return true;
 		%}
@@ -96,9 +96,9 @@ refine flow File += {
 		%{
 		if ( pe_file_header )
 			{
-			auto fh = make_intrusive<RecordVal>(zeek::BifType::Record::PE::FileHeader);
+			auto fh = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::PE::FileHeader);
 			fh->Assign(0, val_mgr->Count(${h.Machine}));
-			fh->Assign(1, make_intrusive<TimeVal>(static_cast<double>(${h.TimeDateStamp})));
+			fh->Assign(1, zeek::make_intrusive<TimeVal>(static_cast<double>(${h.TimeDateStamp})));
 			fh->Assign(2, val_mgr->Count(${h.PointerToSymbolTable}));
 			fh->Assign(3, val_mgr->Count(${h.NumberOfSymbols}));
 			fh->Assign(4, val_mgr->Count(${h.SizeOfOptionalHeader}));
@@ -124,7 +124,7 @@ refine flow File += {
 
 		if ( pe_optional_header )
 			{
-			auto oh = make_intrusive<RecordVal>(zeek::BifType::Record::PE::OptionalHeader);
+			auto oh = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::PE::OptionalHeader);
 
 			oh->Assign(0, val_mgr->Count(${h.magic}));
 			oh->Assign(1, val_mgr->Count(${h.major_linker_version}));
@@ -166,7 +166,7 @@ refine flow File += {
 		%{
 		if ( pe_section_header )
 			{
-			auto section_header = make_intrusive<RecordVal>(zeek::BifType::Record::PE::SectionHeader);
+			auto section_header = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::PE::SectionHeader);
 
 			// Strip null characters from the end of the section name.
 			u_char* first_null = (u_char*) memchr(${h.name}.data(), 0, ${h.name}.length());
@@ -175,7 +175,7 @@ refine flow File += {
 				name_len = ${h.name}.length();
 			else
 				name_len = first_null - ${h.name}.data();
-			section_header->Assign(0, make_intrusive<StringVal>(name_len, (const char*) ${h.name}.data()));
+			section_header->Assign(0, zeek::make_intrusive<StringVal>(name_len, (const char*) ${h.name}.data()));
 
 			section_header->Assign(1, val_mgr->Count(${h.virtual_size}));
 			section_header->Assign(2, val_mgr->Count(${h.virtual_addr}));
diff --git a/src/file_analysis/analyzer/unified2/Unified2.cc b/src/file_analysis/analyzer/unified2/Unified2.cc
index e9b14373c6..d0cd8c53ff 100644
--- a/src/file_analysis/analyzer/unified2/Unified2.cc
+++ b/src/file_analysis/analyzer/unified2/Unified2.cc
@@ -5,7 +5,7 @@
 
 using namespace file_analysis;
 
-Unified2::Unified2(IntrusivePtr<RecordVal> args, File* file)
+Unified2::Unified2(zeek::IntrusivePtr<RecordVal> args, File* file)
     : file_analysis::Analyzer(file_mgr->GetComponentTag("UNIFIED2"), std::move(args), file)
 	{
 	interp = new binpac::Unified2::Unified2_Analyzer(this);
@@ -16,7 +16,7 @@ Unified2::~Unified2()
 	delete interp;
 	}
 
-file_analysis::Analyzer* Unified2::Instantiate(IntrusivePtr<RecordVal> args, File* file)
+file_analysis::Analyzer* Unified2::Instantiate(zeek::IntrusivePtr<RecordVal> args, File* file)
 	{
 	return new Unified2(std::move(args), file);
 	}
diff --git a/src/file_analysis/analyzer/unified2/Unified2.h b/src/file_analysis/analyzer/unified2/Unified2.h
index b65c25e0a1..39a00d073c 100644
--- a/src/file_analysis/analyzer/unified2/Unified2.h
+++ b/src/file_analysis/analyzer/unified2/Unified2.h
@@ -20,11 +20,11 @@ public:
 
 	bool DeliverStream(const u_char* data, uint64_t len) override;
 
-	static file_analysis::Analyzer* Instantiate(IntrusivePtr<RecordVal> args,
+	static file_analysis::Analyzer* Instantiate(zeek::IntrusivePtr<RecordVal> args,
 	                                            File* file);
 
 protected:
-	Unified2(IntrusivePtr<RecordVal> args, File* file);
+	Unified2(zeek::IntrusivePtr<RecordVal> args, File* file);
 
 private:
 	binpac::Unified2::Unified2_Analyzer* interp;
diff --git a/src/file_analysis/analyzer/unified2/unified2-analyzer.pac b/src/file_analysis/analyzer/unified2/unified2-analyzer.pac
index f29128dbeb..eabaa6bb4b 100644
--- a/src/file_analysis/analyzer/unified2/unified2-analyzer.pac
+++ b/src/file_analysis/analyzer/unified2/unified2-analyzer.pac
@@ -8,25 +8,25 @@
 %}
 
 %code{
-IntrusivePtr<AddrVal> binpac::Unified2::Flow::unified2_addr_to_bro_addr(std::vector<uint32_t>* a)
+zeek::IntrusivePtr<AddrVal> binpac::Unified2::Flow::unified2_addr_to_bro_addr(std::vector<uint32_t>* a)
 	{
 	if ( a->size() == 1 )
 		{
-		return make_intrusive<AddrVal>(IPAddr(IPv4, &(a->at(0)), IPAddr::Host));
+		return zeek::make_intrusive<AddrVal>(IPAddr(IPv4, &(a->at(0)), IPAddr::Host));
 		}
 	else if ( a->size() == 4 )
 		{
 		uint32 tmp[4] = { a->at(0), a->at(1), a->at(2), a->at(3) };
-		return make_intrusive<AddrVal>(IPAddr(IPv6, tmp, IPAddr::Host));
+		return zeek::make_intrusive<AddrVal>(IPAddr(IPv6, tmp, IPAddr::Host));
 		}
 	else
 		{
 		// Should never reach here.
-		return make_intrusive<AddrVal>(1);
+		return zeek::make_intrusive<AddrVal>(1);
 		}
 	}
 
-IntrusivePtr<Val> binpac::Unified2::Flow::to_port(uint16_t n, uint8_t p)
+zeek::IntrusivePtr<Val> binpac::Unified2::Flow::to_port(uint16_t n, uint8_t p)
 	{
 	TransportProto proto = TRANSPORT_UNKNOWN;
 	switch ( p ) {
@@ -42,8 +42,8 @@ IntrusivePtr<Val> binpac::Unified2::Flow::to_port(uint16_t n, uint8_t p)
 refine flow Flow += {
 
 	%member{
-		IntrusivePtr<AddrVal> unified2_addr_to_bro_addr(std::vector<uint32_t>* a);
-		IntrusivePtr<Val> to_port(uint16_t n, uint8_t p);
+		zeek::IntrusivePtr<AddrVal> unified2_addr_to_bro_addr(std::vector<uint32_t>* a);
+		zeek::IntrusivePtr<Val> to_port(uint16_t n, uint8_t p);
 	%}
 
 	%init{
@@ -71,10 +71,10 @@ refine flow Flow += {
 		%{
 		if ( ::unified2_event )
 			{
-			auto ids_event = make_intrusive<RecordVal>(zeek::BifType::Record::Unified2::IDSEvent);
+			auto ids_event = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::Unified2::IDSEvent);
 			ids_event->Assign(0, val_mgr->Count(${ev.sensor_id}));
 			ids_event->Assign(1, val_mgr->Count(${ev.event_id}));
-			ids_event->Assign(2, make_intrusive<TimeVal>(ts_to_double(${ev.ts})));
+			ids_event->Assign(2, zeek::make_intrusive<TimeVal>(ts_to_double(${ev.ts})));
 			ids_event->Assign(3, val_mgr->Count(${ev.signature_id}));
 			ids_event->Assign(4, val_mgr->Count(${ev.generator_id}));
 			ids_event->Assign(5, val_mgr->Count(${ev.signature_revision}));
@@ -97,10 +97,10 @@ refine flow Flow += {
 		%{
 		if ( ::unified2_event )
 			{
-			auto ids_event = make_intrusive<RecordVal>(zeek::BifType::Record::Unified2::IDSEvent);
+			auto ids_event = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::Unified2::IDSEvent);
 			ids_event->Assign(0, val_mgr->Count(${ev.sensor_id}));
 			ids_event->Assign(1, val_mgr->Count(${ev.event_id}));
-			ids_event->Assign(2, make_intrusive<TimeVal>(ts_to_double(${ev.ts})));
+			ids_event->Assign(2, zeek::make_intrusive<TimeVal>(ts_to_double(${ev.ts})));
 			ids_event->Assign(3, val_mgr->Count(${ev.signature_id}));
 			ids_event->Assign(4, val_mgr->Count(${ev.generator_id}));
 			ids_event->Assign(5, val_mgr->Count(${ev.signature_revision}));
@@ -128,11 +128,11 @@ refine flow Flow += {
 		%{
 		if ( ::unified2_packet )
 			{
-			auto packet = make_intrusive<RecordVal>(zeek::BifType::Record::Unified2::Packet);
+			auto packet = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::Unified2::Packet);
 			packet->Assign(0, val_mgr->Count(${pkt.sensor_id}));
 			packet->Assign(1, val_mgr->Count(${pkt.event_id}));
 			packet->Assign(2, val_mgr->Count(${pkt.event_second}));
-			packet->Assign(3, make_intrusive<TimeVal>(ts_to_double(${pkt.packet_ts})));
+			packet->Assign(3, zeek::make_intrusive<TimeVal>(ts_to_double(${pkt.packet_ts})));
 			packet->Assign(4, val_mgr->Count(${pkt.link_type}));
 			packet->Assign(5, to_stringval(${pkt.packet_data}));
 
diff --git a/src/file_analysis/analyzer/x509/OCSP.cc b/src/file_analysis/analyzer/x509/OCSP.cc
index 972742b5c3..1ba8b5f132 100644
--- a/src/file_analysis/analyzer/x509/OCSP.cc
+++ b/src/file_analysis/analyzer/x509/OCSP.cc
@@ -1,3 +1,4 @@
+
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include <string>
@@ -91,40 +92,40 @@ static bool ocsp_add_cert_id(const OCSP_CERTID* cert_id, zeek::Args* vl, BIO* bi
 
 	i2a_ASN1_OBJECT(bio, hash_alg);
 	int len = BIO_read(bio, buf, sizeof(buf));
-	vl->emplace_back(make_intrusive<StringVal>(len, buf));
+	vl->emplace_back(zeek::make_intrusive<StringVal>(len, buf));
 	BIO_reset(bio);
 
 	i2a_ASN1_STRING(bio, issuer_name_hash, V_ASN1_OCTET_STRING);
 	len = BIO_read(bio, buf, sizeof(buf));
-	vl->emplace_back(make_intrusive<StringVal>(len, buf));
+	vl->emplace_back(zeek::make_intrusive<StringVal>(len, buf));
 	BIO_reset(bio);
 
 	i2a_ASN1_STRING(bio, issuer_key_hash, V_ASN1_OCTET_STRING);
 	len = BIO_read(bio, buf, sizeof(buf));
-	vl->emplace_back(make_intrusive<StringVal>(len, buf));
+	vl->emplace_back(zeek::make_intrusive<StringVal>(len, buf));
 	BIO_reset(bio);
 
 	i2a_ASN1_INTEGER(bio, serial_number);
 	len = BIO_read(bio, buf, sizeof(buf));
-	vl->emplace_back(make_intrusive<StringVal>(len, buf));
+	vl->emplace_back(zeek::make_intrusive<StringVal>(len, buf));
 	BIO_reset(bio);
 
 	return true;
 	}
 
-file_analysis::Analyzer* OCSP::InstantiateRequest(IntrusivePtr<RecordVal> args,
+file_analysis::Analyzer* OCSP::InstantiateRequest(zeek::IntrusivePtr<RecordVal> args,
                                                   File* file)
 	{
 	return new OCSP(std::move(args), file, true);
 	}
 
-file_analysis::Analyzer* OCSP::InstantiateReply(IntrusivePtr<RecordVal> args,
+file_analysis::Analyzer* OCSP::InstantiateReply(zeek::IntrusivePtr<RecordVal> args,
                                                 File* file)
 	{
 	return new OCSP(std::move(args), file, false);
 	}
 
-file_analysis::OCSP::OCSP(IntrusivePtr<RecordVal> args, file_analysis::File* file,
+file_analysis::OCSP::OCSP(zeek::IntrusivePtr<RecordVal> args, file_analysis::File* file,
                           bool arg_request)
 	: file_analysis::X509Common::X509Common(file_mgr->GetComponentTag("OCSP"),
 	                                        std::move(args), file),
@@ -210,9 +211,9 @@ typedef struct ocsp_basic_response_st {
     STACK_OF(X509) *certs;
 } OCSP_BASICRESP;
 */
-static IntrusivePtr<StringVal> parse_basic_resp_sig_alg(OCSP_BASICRESP* basic_resp,
-                                                        BIO* bio, char* buf,
-                                                        size_t buf_len)
+static zeek::IntrusivePtr<StringVal> parse_basic_resp_sig_alg(OCSP_BASICRESP* basic_resp,
+                                                              BIO* bio, char* buf,
+                                                              size_t buf_len)
 	{
 	int der_basic_resp_len = 0;
 	unsigned char* der_basic_resp_dat = nullptr;
@@ -277,14 +278,14 @@ static IntrusivePtr<StringVal> parse_basic_resp_sig_alg(OCSP_BASICRESP* basic_re
 	auto alg_obj = alg_obj_type->value.object;
 	i2a_ASN1_OBJECT(bio, alg_obj);
 	auto alg_len = BIO_read(bio, buf, buf_len);
-	auto rval = make_intrusive<StringVal>(alg_len, buf);
+	auto rval = zeek::make_intrusive<StringVal>(alg_len, buf);
 	BIO_reset(bio);
 
 	OPENSSL_free(der_basic_resp_dat);
 	return rval;
 	}
 
-static IntrusivePtr<Val> parse_basic_resp_data_version(OCSP_BASICRESP* basic_resp)
+static zeek::IntrusivePtr<Val> parse_basic_resp_data_version(OCSP_BASICRESP* basic_resp)
 	{
 	int der_basic_resp_len = 0;
 	unsigned char* der_basic_resp_dat = nullptr;
@@ -459,7 +460,7 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp)
 	memset(buf, 0, sizeof(buf));
 
 	const char *status_str = OCSP_response_status_str(OCSP_response_status(resp));
-	auto status_val = make_intrusive<StringVal>(strlen(status_str), status_str);
+	auto status_val = zeek::make_intrusive<StringVal>(strlen(status_str), status_str);
 
 	if ( ocsp_response_status )
 		mgr.Enqueue(ocsp_response_status, GetFile()->ToVal(), status_val);
@@ -502,7 +503,7 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp)
 	if ( OCSP_RESPID_bio(basic_resp, bio) )
 		{
 		len = BIO_read(bio, buf, sizeof(buf));
-		vl.emplace_back(make_intrusive<StringVal>(len, buf));
+		vl.emplace_back(zeek::make_intrusive<StringVal>(len, buf));
 		BIO_reset(bio);
 		}
 	else
@@ -518,7 +519,7 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp)
 	produced_at = OCSP_resp_get0_produced_at(basic_resp);
 #endif
 
-	vl.emplace_back(make_intrusive<TimeVal>(GetTimeFromAsn1(produced_at, GetFile(), reporter)));
+	vl.emplace_back(zeek::make_intrusive<TimeVal>(GetTimeFromAsn1(produced_at, GetFile(), reporter)));
 
 	// responses
 
@@ -561,36 +562,36 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp)
 			reporter->Weird("OpenSSL failed to find status of OCSP response");
 
 		const char* cert_status_str = OCSP_cert_status_str(status);
-		rvl.emplace_back(make_intrusive<StringVal>(strlen(cert_status_str), cert_status_str));
+		rvl.emplace_back(zeek::make_intrusive<StringVal>(strlen(cert_status_str), cert_status_str));
 
 		// revocation time and reason if revoked
 		if ( status == V_OCSP_CERTSTATUS_REVOKED )
 			{
-			rvl.emplace_back(make_intrusive<TimeVal>(GetTimeFromAsn1(revoke_time, GetFile(), reporter)));
+			rvl.emplace_back(zeek::make_intrusive<TimeVal>(GetTimeFromAsn1(revoke_time, GetFile(), reporter)));
 
 			if ( reason != OCSP_REVOKED_STATUS_NOSTATUS )
 				{
 				const char* revoke_reason = OCSP_crl_reason_str(reason);
-				rvl.emplace_back(make_intrusive<StringVal>(strlen(revoke_reason), revoke_reason));
+				rvl.emplace_back(zeek::make_intrusive<StringVal>(strlen(revoke_reason), revoke_reason));
 				}
 			else
-				rvl.emplace_back(make_intrusive<StringVal>(0, ""));
+				rvl.emplace_back(zeek::make_intrusive<StringVal>(0, ""));
 			}
 		else
 			{
-			rvl.emplace_back(make_intrusive<TimeVal>(0.0));
-			rvl.emplace_back(make_intrusive<StringVal>(0, ""));
+			rvl.emplace_back(zeek::make_intrusive<TimeVal>(0.0));
+			rvl.emplace_back(zeek::make_intrusive<StringVal>(0, ""));
 			}
 
 		if ( this_update )
-			rvl.emplace_back(make_intrusive<TimeVal>(GetTimeFromAsn1(this_update, GetFile(), reporter)));
+			rvl.emplace_back(zeek::make_intrusive<TimeVal>(GetTimeFromAsn1(this_update, GetFile(), reporter)));
 		else
-			rvl.emplace_back(make_intrusive<TimeVal>(0.0));
+			rvl.emplace_back(zeek::make_intrusive<TimeVal>(0.0));
 
 		if ( next_update )
-			rvl.emplace_back(make_intrusive<TimeVal>(GetTimeFromAsn1(next_update, GetFile(), reporter)));
+			rvl.emplace_back(zeek::make_intrusive<TimeVal>(GetTimeFromAsn1(next_update, GetFile(), reporter)));
 		else
-			rvl.emplace_back(make_intrusive<TimeVal>(0.0));
+			rvl.emplace_back(zeek::make_intrusive<TimeVal>(0.0));
 
 		if ( ocsp_response_certificate )
 			mgr.Enqueue(ocsp_response_certificate, std::move(rvl));
@@ -609,7 +610,7 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp)
 #if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
 	i2a_ASN1_OBJECT(bio, basic_resp->signatureAlgorithm->algorithm);
 	len = BIO_read(bio, buf, sizeof(buf));
-	vl.emplace_back(make_intrusive<StringVal>(len, buf));
+	vl.emplace_back(zeek::make_intrusive<StringVal>(len, buf));
 	BIO_reset(bio);
 #else
 	vl.emplace_back(parse_basic_resp_sig_alg(basic_resp, bio, buf, sizeof(buf)));
@@ -617,11 +618,11 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp)
 
 	//i2a_ASN1_OBJECT(bio, basic_resp->signature);
 	//len = BIO_read(bio, buf, sizeof(buf));
-	//ocsp_resp_record->Assign(7, make_intrusive<StringVal>(len, buf));
+	//ocsp_resp_record->Assign(7, zeek::make_intrusive<StringVal>(len, buf));
 	//BIO_reset(bio);
 
 	certs_vector = new VectorVal(zeek::id::find_type<zeek::VectorType>("x509_opaque_vector"));
-	vl.emplace_back(AdoptRef{}, certs_vector);
+	vl.emplace_back(zeek::AdoptRef{}, certs_vector);
 
 #if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
 	certs = basic_resp->certs;
@@ -637,7 +638,7 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp)
 			::X509 *this_cert = X509_dup(helper_sk_X509_value(certs, i));
 			//::X509 *this_cert = X509_dup(sk_X509_value(certs, i));
 			if (this_cert)
-				certs_vector->Assign(i, make_intrusive<file_analysis::X509Val>(this_cert));
+				certs_vector->Assign(i, zeek::make_intrusive<file_analysis::X509Val>(this_cert));
 			else
 				reporter->Weird("OpenSSL returned null certificate");
 			}
diff --git a/src/file_analysis/analyzer/x509/OCSP.h b/src/file_analysis/analyzer/x509/OCSP.h
index c3cec77cec..f9d235b23c 100644
--- a/src/file_analysis/analyzer/x509/OCSP.h
+++ b/src/file_analysis/analyzer/x509/OCSP.h
@@ -18,13 +18,13 @@ public:
 	bool Undelivered(uint64_t offset, uint64_t len) override;
 	bool EndOfFile() override;
 
-	static file_analysis::Analyzer* InstantiateRequest(IntrusivePtr<RecordVal> args,
+	static file_analysis::Analyzer* InstantiateRequest(zeek::IntrusivePtr<RecordVal> args,
 	                                                   File* file);
-	static file_analysis::Analyzer* InstantiateReply(IntrusivePtr<RecordVal> args,
+	static file_analysis::Analyzer* InstantiateReply(zeek::IntrusivePtr<RecordVal> args,
 	                                                 File* file);
 
 protected:
-	OCSP(IntrusivePtr<RecordVal> args, File* file, bool request);
+	OCSP(zeek::IntrusivePtr<RecordVal> args, File* file, bool request);
 
 private:
 	void ParseResponse(OCSP_RESPONSE*);
diff --git a/src/file_analysis/analyzer/x509/X509.cc b/src/file_analysis/analyzer/x509/X509.cc
index a5cd0a1ce2..ff74f61592 100644
--- a/src/file_analysis/analyzer/x509/X509.cc
+++ b/src/file_analysis/analyzer/x509/X509.cc
@@ -23,7 +23,7 @@
 
 using namespace file_analysis;
 
-file_analysis::X509::X509(IntrusivePtr<RecordVal> args, file_analysis::File* file)
+file_analysis::X509::X509(zeek::IntrusivePtr<RecordVal> args, file_analysis::File* file)
 	: file_analysis::X509Common::X509Common(file_mgr->GetComponentTag("X509"),
 	                                        std::move(args), file)
 	{
@@ -53,7 +53,7 @@ bool file_analysis::X509::EndOfFile()
 		hash_update(ctx, cert_char, cert_data.size());
 		hash_final(ctx, buf);
 		std::string cert_sha256 = sha256_digest_print(buf);
-		auto index = make_intrusive<StringVal>(cert_sha256);
+		auto index = zeek::make_intrusive<StringVal>(cert_sha256);
 		const auto& entry = certificate_cache->Find(index);
 
 		if ( entry )
@@ -65,7 +65,7 @@ bool file_analysis::X509::EndOfFile()
 			// yup, let's call the callback.
 
 			cache_hit_callback->Invoke(GetFile()->ToVal(), entry,
-			                           make_intrusive<StringVal>(cert_sha256));
+			                           zeek::make_intrusive<StringVal>(cert_sha256));
 			return false;
 			}
 		}
@@ -88,7 +88,7 @@ bool file_analysis::X509::EndOfFile()
 	if ( x509_certificate )
 		mgr.Enqueue(x509_certificate,
 		            GetFile()->ToVal(),
-		            IntrusivePtr{NewRef{}, cert_val},
+		            zeek::IntrusivePtr{zeek::NewRef{}, cert_val},
 		            cert_record);
 
 	// after parsing the certificate - parse the extensions...
@@ -113,25 +113,25 @@ bool file_analysis::X509::EndOfFile()
 	return false;
 	}
 
-IntrusivePtr<RecordVal> file_analysis::X509::ParseCertificate(X509Val* cert_val, File* f)
+zeek::IntrusivePtr<RecordVal> file_analysis::X509::ParseCertificate(X509Val* cert_val, File* f)
 	{
 	::X509* ssl_cert = cert_val->GetCertificate();
 
 	char buf[2048]; // we need a buffer for some of the openssl functions
 	memset(buf, 0, sizeof(buf));
 
-	auto pX509Cert = make_intrusive<RecordVal>(zeek::BifType::Record::X509::Certificate);
+	auto pX509Cert = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::X509::Certificate);
 	BIO *bio = BIO_new(BIO_s_mem());
 
 	pX509Cert->Assign(0, val_mgr->Count((uint64_t) X509_get_version(ssl_cert) + 1));
 	i2a_ASN1_INTEGER(bio, X509_get_serialNumber(ssl_cert));
 	int len = BIO_read(bio, buf, sizeof(buf));
-	pX509Cert->Assign(1, make_intrusive<StringVal>(len, buf));
+	pX509Cert->Assign(1, zeek::make_intrusive<StringVal>(len, buf));
 	BIO_reset(bio);
 
 	X509_NAME_print_ex(bio, X509_get_subject_name(ssl_cert), 0, XN_FLAG_RFC2253);
 	len = BIO_gets(bio, buf, sizeof(buf));
-	pX509Cert->Assign(2, make_intrusive<StringVal>(len, buf));
+	pX509Cert->Assign(2, zeek::make_intrusive<StringVal>(len, buf));
 	BIO_reset(bio);
 
 	X509_NAME *subject_name = X509_get_subject_name(ssl_cert);
@@ -151,17 +151,17 @@ IntrusivePtr<RecordVal> file_analysis::X509::ParseCertificate(X509Val* cert_val,
 		// we found a common name
 		ASN1_STRING_print(bio, X509_NAME_ENTRY_get_data(X509_NAME_get_entry(subject_name, namepos)));
 		len = BIO_gets(bio, buf, sizeof(buf));
-		pX509Cert->Assign(4, make_intrusive<StringVal>(len, buf));
+		pX509Cert->Assign(4, zeek::make_intrusive<StringVal>(len, buf));
 		BIO_reset(bio);
 		}
 
 	X509_NAME_print_ex(bio, X509_get_issuer_name(ssl_cert), 0, XN_FLAG_RFC2253);
 	len = BIO_gets(bio, buf, sizeof(buf));
-	pX509Cert->Assign(3, make_intrusive<StringVal>(len, buf));
+	pX509Cert->Assign(3, zeek::make_intrusive<StringVal>(len, buf));
 	BIO_free(bio);
 
-	pX509Cert->Assign(5, make_intrusive<TimeVal>(GetTimeFromAsn1(X509_get_notBefore(ssl_cert), f, reporter)));
-	pX509Cert->Assign(6, make_intrusive<TimeVal>(GetTimeFromAsn1(X509_get_notAfter(ssl_cert), f, reporter)));
+	pX509Cert->Assign(5, zeek::make_intrusive<TimeVal>(GetTimeFromAsn1(X509_get_notBefore(ssl_cert), f, reporter)));
+	pX509Cert->Assign(6, zeek::make_intrusive<TimeVal>(GetTimeFromAsn1(X509_get_notAfter(ssl_cert), f, reporter)));
 
 	// we only read 255 bytes because byte 256 is always 0.
 	// if the string is longer than 255, that will be our null-termination,
@@ -171,7 +171,7 @@ IntrusivePtr<RecordVal> file_analysis::X509::ParseCertificate(X509Val* cert_val,
 	if ( ! i2t_ASN1_OBJECT(buf, 255, algorithm) )
 		buf[0] = 0;
 
-	pX509Cert->Assign(7, make_intrusive<StringVal>(buf));
+	pX509Cert->Assign(7, zeek::make_intrusive<StringVal>(buf));
 
 	// Special case for RDP server certificates. For some reason some (all?) RDP server
 	// certificates like to specify their key algorithm as md5WithRSAEncryption, which
@@ -193,25 +193,25 @@ IntrusivePtr<RecordVal> file_analysis::X509::ParseCertificate(X509Val* cert_val,
 	if ( ! i2t_ASN1_OBJECT(buf, 255, OBJ_nid2obj(X509_get_signature_nid(ssl_cert))) )
 		buf[0] = 0;
 
-	pX509Cert->Assign(8, make_intrusive<StringVal>(buf));
+	pX509Cert->Assign(8, zeek::make_intrusive<StringVal>(buf));
 
 	// Things we can do when we have the key...
 	EVP_PKEY *pkey = X509_extract_key(ssl_cert);
 	if ( pkey != NULL )
 		{
 		if ( EVP_PKEY_base_id(pkey) == EVP_PKEY_DSA )
-			pX509Cert->Assign(9, make_intrusive<StringVal>("dsa"));
+			pX509Cert->Assign(9, zeek::make_intrusive<StringVal>("dsa"));
 
 		else if ( EVP_PKEY_base_id(pkey) == EVP_PKEY_RSA )
 			{
-			pX509Cert->Assign(9, make_intrusive<StringVal>("rsa"));
+			pX509Cert->Assign(9, zeek::make_intrusive<StringVal>("rsa"));
 
 			const BIGNUM *e;
 			RSA_get0_key(EVP_PKEY_get0_RSA(pkey), NULL, &e, NULL);
 			char *exponent = BN_bn2dec(e);
 			if ( exponent != NULL )
 				{
-				pX509Cert->Assign(11, make_intrusive<StringVal>(exponent));
+				pX509Cert->Assign(11, zeek::make_intrusive<StringVal>(exponent));
 				OPENSSL_free(exponent);
 				exponent = NULL;
 				}
@@ -219,7 +219,7 @@ IntrusivePtr<RecordVal> file_analysis::X509::ParseCertificate(X509Val* cert_val,
 #ifndef OPENSSL_NO_EC
 		else if ( EVP_PKEY_base_id(pkey) == EVP_PKEY_EC )
 			{
-			pX509Cert->Assign(9, make_intrusive<StringVal>("ecdsa"));
+			pX509Cert->Assign(9, zeek::make_intrusive<StringVal>("ecdsa"));
 			pX509Cert->Assign(12, KeyCurve(pkey));
 			}
 #endif
@@ -290,7 +290,7 @@ void file_analysis::X509::ParseBasicConstraints(X509_EXTENSION* ex)
 		{
 		if ( x509_ext_basic_constraints )
 			{
-			auto pBasicConstraint = make_intrusive<RecordVal>(zeek::BifType::Record::X509::BasicConstraints);
+			auto pBasicConstraint = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::X509::BasicConstraints);
 			pBasicConstraint->Assign(0, val_mgr->Bool(constr->ca));
 
 			if ( constr->pathlen )
@@ -340,10 +340,10 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext)
 		return;
 		}
 
-	IntrusivePtr<VectorVal> names;
-	IntrusivePtr<VectorVal> emails;
-	IntrusivePtr<VectorVal> uris;
-	IntrusivePtr<VectorVal> ips;
+	zeek::IntrusivePtr<VectorVal> names;
+	zeek::IntrusivePtr<VectorVal> emails;
+	zeek::IntrusivePtr<VectorVal> uris;
+	zeek::IntrusivePtr<VectorVal> ips;
 
 	bool otherfields = false;
 
@@ -365,27 +365,27 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext)
 #else
 			const char* name = (const char*) ASN1_STRING_get0_data(gen->d.ia5);
 #endif
-			auto bs = make_intrusive<StringVal>(name);
+			auto bs = zeek::make_intrusive<StringVal>(name);
 
 			switch ( gen->type )
 				{
 				case GEN_DNS:
 					if ( names == nullptr )
-						names = make_intrusive<VectorVal>(zeek::id::string_vec);
+						names = zeek::make_intrusive<VectorVal>(zeek::id::string_vec);
 
 					names->Assign(names->Size(), std::move(bs));
 					break;
 
 				case GEN_URI:
 					if ( uris == nullptr )
-						uris = make_intrusive<VectorVal>(zeek::id::string_vec);
+						uris = zeek::make_intrusive<VectorVal>(zeek::id::string_vec);
 
 					uris->Assign(uris->Size(), std::move(bs));
 					break;
 
 				case GEN_EMAIL:
 					if ( emails == nullptr )
-						emails = make_intrusive<VectorVal>(zeek::id::string_vec);
+						emails = zeek::make_intrusive<VectorVal>(zeek::id::string_vec);
 
 					emails->Assign(emails->Size(), std::move(bs));
 					break;
@@ -395,15 +395,15 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext)
 		else if ( gen->type == GEN_IPADD )
 			{
 				if ( ips == nullptr )
-					ips = make_intrusive<VectorVal>(zeek::id::find_type<zeek::VectorType>("addr_vec"));
+					ips = zeek::make_intrusive<VectorVal>(zeek::id::find_type<zeek::VectorType>("addr_vec"));
 
 				uint32_t* addr = (uint32_t*) gen->d.ip->data;
 
 				if( gen->d.ip->length == 4 )
-					ips->Assign(ips->Size(), make_intrusive<AddrVal>(*addr));
+					ips->Assign(ips->Size(), zeek::make_intrusive<AddrVal>(*addr));
 
 				else if ( gen->d.ip->length == 16 )
-					ips->Assign(ips->Size(), make_intrusive<AddrVal>(addr));
+					ips->Assign(ips->Size(), zeek::make_intrusive<AddrVal>(addr));
 
 				else
 					{
@@ -421,7 +421,7 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext)
 			}
 		}
 
-		auto sanExt = make_intrusive<RecordVal>(zeek::BifType::Record::X509::SubjectAlternativeName);
+		auto sanExt = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::X509::SubjectAlternativeName);
 
 		if ( names != nullptr )
 			sanExt->Assign(0, names);
@@ -443,7 +443,7 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext)
 	GENERAL_NAMES_free(altname);
 	}
 
-IntrusivePtr<StringVal> file_analysis::X509::KeyCurve(EVP_PKEY* key)
+zeek::IntrusivePtr<StringVal> file_analysis::X509::KeyCurve(EVP_PKEY* key)
 	{
 	assert(key != nullptr);
 
@@ -472,7 +472,7 @@ IntrusivePtr<StringVal> file_analysis::X509::KeyCurve(EVP_PKEY* key)
 	if ( curve_name == nullptr )
 		return nullptr;
 
-	return make_intrusive<StringVal>(curve_name);
+	return zeek::make_intrusive<StringVal>(curve_name);
 #endif
 	}
 
@@ -543,9 +543,9 @@ X509Val::~X509Val()
 		X509_free(certificate);
 	}
 
-IntrusivePtr<Val> X509Val::DoClone(CloneState* state)
+zeek::IntrusivePtr<Val> X509Val::DoClone(CloneState* state)
 	{
-	auto copy = make_intrusive<X509Val>();
+	auto copy = zeek::make_intrusive<X509Val>();
 	if ( certificate )
 		copy->certificate = X509_dup(certificate);
 
diff --git a/src/file_analysis/analyzer/x509/X509.h b/src/file_analysis/analyzer/x509/X509.h
index 092ac9aa94..f7c49eb11d 100644
--- a/src/file_analysis/analyzer/x509/X509.h
+++ b/src/file_analysis/analyzer/x509/X509.h
@@ -86,9 +86,9 @@ public:
 	 * @param Returns the new record value and passes ownership to
 	 * caller.
 	 */
-	static IntrusivePtr<RecordVal> ParseCertificate(X509Val* cert_val, File* file = nullptr);
+	static zeek::IntrusivePtr<RecordVal> ParseCertificate(X509Val* cert_val, File* file = nullptr);
 
-	static file_analysis::Analyzer* Instantiate(IntrusivePtr<RecordVal> args,
+	static file_analysis::Analyzer* Instantiate(zeek::IntrusivePtr<RecordVal> args,
 	                                            File* file)
 		{ return new X509(std::move(args), file); }
 
@@ -117,17 +117,17 @@ public:
 	/**
 	 * Sets the table[string] that used as the certificate cache inside of Zeek.
 	 */
-	static void SetCertificateCache(IntrusivePtr<TableVal> cache)
+	static void SetCertificateCache(zeek::IntrusivePtr<TableVal> cache)
 		{ certificate_cache = std::move(cache); }
 
 	/**
 	 * Sets the callback when a certificate cache hit is encountered
 	 */
-	static void SetCertificateCacheHitCallback(IntrusivePtr<Func> func)
+	static void SetCertificateCacheHitCallback(zeek::IntrusivePtr<Func> func)
 		{ cache_hit_callback = std::move(func); }
 
 protected:
-	X509(IntrusivePtr<RecordVal> args, File* file);
+	X509(zeek::IntrusivePtr<RecordVal> args, File* file);
 
 private:
 	void ParseBasicConstraints(X509_EXTENSION* ex);
@@ -137,12 +137,12 @@ private:
 	std::string cert_data;
 
 	// Helpers for ParseCertificate.
-	static IntrusivePtr<StringVal> KeyCurve(EVP_PKEY* key);
+	static zeek::IntrusivePtr<StringVal> KeyCurve(EVP_PKEY* key);
 	static unsigned int KeyLength(EVP_PKEY *key);
 	/** X509 stores associated with global script-layer values */
 	inline static std::map<Val*, X509_STORE*> x509_stores = std::map<Val*, X509_STORE*>();
-	inline static IntrusivePtr<TableVal> certificate_cache = nullptr;
-	inline static IntrusivePtr<Func> cache_hit_callback = nullptr;
+	inline static zeek::IntrusivePtr<TableVal> certificate_cache = nullptr;
+	inline static zeek::IntrusivePtr<Func> cache_hit_callback = nullptr;
 };
 
 /**
@@ -170,7 +170,7 @@ public:
 	 *
 	 * @return A cloned X509Val.
 	 */
-	IntrusivePtr<Val> DoClone(CloneState* state) override;
+	zeek::IntrusivePtr<Val> DoClone(CloneState* state) override;
 
 	/**
 	 * Destructor.
diff --git a/src/file_analysis/analyzer/x509/X509Common.cc b/src/file_analysis/analyzer/x509/X509Common.cc
index e30ac06f7c..4eba1cbaef 100644
--- a/src/file_analysis/analyzer/x509/X509Common.cc
+++ b/src/file_analysis/analyzer/x509/X509Common.cc
@@ -17,7 +17,7 @@
 using namespace file_analysis;
 
 X509Common::X509Common(const file_analysis::Tag& arg_tag,
-                       IntrusivePtr<RecordVal> arg_args, File* arg_file)
+                       zeek::IntrusivePtr<RecordVal> arg_args, File* arg_file)
 	: file_analysis::Analyzer(arg_tag, std::move(arg_args), arg_file)
 	{
 	}
@@ -268,15 +268,15 @@ void file_analysis::X509Common::ParseExtension(X509_EXTENSION* ex, const EventHa
 		}
 
 	if ( ! ext_val )
-		ext_val = make_intrusive<StringVal>(0, "");
+		ext_val = zeek::make_intrusive<StringVal>(0, "");
 
-	auto pX509Ext = make_intrusive<RecordVal>(zeek::BifType::Record::X509::Extension);
-	pX509Ext->Assign(0, make_intrusive<StringVal>(name));
+	auto pX509Ext = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::X509::Extension);
+	pX509Ext->Assign(0, zeek::make_intrusive<StringVal>(name));
 
 	if ( short_name and strlen(short_name) > 0 )
-		pX509Ext->Assign(1, make_intrusive<StringVal>(short_name));
+		pX509Ext->Assign(1, zeek::make_intrusive<StringVal>(short_name));
 
-	pX509Ext->Assign(2, make_intrusive<StringVal>(oid));
+	pX509Ext->Assign(2, zeek::make_intrusive<StringVal>(oid));
 	pX509Ext->Assign(3, val_mgr->Bool(critical));
 	pX509Ext->Assign(4, ext_val);
 
@@ -298,7 +298,7 @@ void file_analysis::X509Common::ParseExtension(X509_EXTENSION* ex, const EventHa
 	ParseExtensionsSpecific(ex, global, ext_asn, oid);
 	}
 
-IntrusivePtr<StringVal> file_analysis::X509Common::GetExtensionFromBIO(BIO* bio, File* f)
+zeek::IntrusivePtr<StringVal> file_analysis::X509Common::GetExtensionFromBIO(BIO* bio, File* f)
 	{
 	BIO_flush(bio);
 	ERR_clear_error();
@@ -331,7 +331,7 @@ IntrusivePtr<StringVal> file_analysis::X509Common::GetExtensionFromBIO(BIO* bio,
 		}
 
 	BIO_read(bio, (void*) buffer, length);
-	auto ext_val = make_intrusive<StringVal>(length, buffer);
+	auto ext_val = zeek::make_intrusive<StringVal>(length, buffer);
 
 	free(buffer);
 	BIO_free_all(bio);
diff --git a/src/file_analysis/analyzer/x509/X509Common.h b/src/file_analysis/analyzer/x509/X509Common.h
index a7c9254d0b..f8b399f9ee 100644
--- a/src/file_analysis/analyzer/x509/X509Common.h
+++ b/src/file_analysis/analyzer/x509/X509Common.h
@@ -35,13 +35,13 @@ public:
 	 *
 	 * @return The X509 extension value.
 	 */
-	static IntrusivePtr<StringVal> GetExtensionFromBIO(BIO* bio, File* f = nullptr);
+	static zeek::IntrusivePtr<StringVal> GetExtensionFromBIO(BIO* bio, File* f = nullptr);
 
 	static double GetTimeFromAsn1(const ASN1_TIME* atime, File* f, Reporter* reporter);
 
 protected:
 	X509Common(const file_analysis::Tag& arg_tag,
-	           IntrusivePtr<RecordVal> arg_args, File* arg_file);
+	           zeek::IntrusivePtr<RecordVal> arg_args, File* arg_file);
 
 	void ParseExtension(X509_EXTENSION* ex, const EventHandlerPtr& h, bool global);
 	void ParseSignedCertificateTimestamps(X509_EXTENSION* ext);
diff --git a/src/file_analysis/analyzer/x509/functions.bif b/src/file_analysis/analyzer/x509/functions.bif
index 214c10f24a..fdea883934 100644
--- a/src/file_analysis/analyzer/x509/functions.bif
+++ b/src/file_analysis/analyzer/x509/functions.bif
@@ -11,12 +11,12 @@
 #include <openssl/err.h>
 
 // construct an error record
-static IntrusivePtr<RecordVal> x509_result_record(uint64_t num, const char* reason, IntrusivePtr<Val> chainVector = nullptr)
+static zeek::IntrusivePtr<RecordVal> x509_result_record(uint64_t num, const char* reason, zeek::IntrusivePtr<Val> chainVector = nullptr)
 	{
-	auto rrecord = make_intrusive<RecordVal>(zeek::BifType::Record::X509::Result);
+	auto rrecord = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::X509::Result);
 
 	rrecord->Assign(0, val_mgr->Int(num));
-	rrecord->Assign(1, make_intrusive<StringVal>(reason));
+	rrecord->Assign(1, zeek::make_intrusive<StringVal>(reason));
 	if ( chainVector )
 		rrecord->Assign(2, std::move(chainVector));
 
@@ -161,7 +161,7 @@ function x509_parse%(cert: opaque of x509%): X509::Certificate
 function x509_from_der%(der: string%): opaque of x509
     %{
     const u_char* data = der->Bytes();
-    return make_intrusive<file_analysis::X509Val>(d2i_X509(nullptr, &data, der->Len()));
+    return zeek::make_intrusive<file_analysis::X509Val>(d2i_X509(nullptr, &data, der->Len()));
     %}
 
 ## Returns the string form of a certificate.
@@ -215,7 +215,7 @@ function x509_get_certificate_string%(cert: opaque of x509, pem: bool &default=F
 ##              x509_get_certificate_string x509_verify
 function x509_ocsp_verify%(certs: x509_opaque_vector, ocsp_reply: string, root_certs: table_string_of_string, verify_time: time &default=network_time()%): X509::Result
 	%{
-	IntrusivePtr<RecordVal> rval;
+	zeek::IntrusivePtr<RecordVal> rval;
 	X509_STORE* ctx = ::file_analysis::X509::GetRootStore(root_certs->AsTableVal());
 	if ( ! ctx )
 		return x509_result_record(-1, "Problem initializing root store");
@@ -542,7 +542,7 @@ function x509_verify%(certs: x509_opaque_vector, root_certs: table_string_of_str
 
 	int result = X509_verify_cert(csc);
 
-	IntrusivePtr<VectorVal> chainVector;
+	zeek::IntrusivePtr<VectorVal> chainVector;
 
 	if ( result == 1 ) // we have a valid chain. try to get it...
 		{
@@ -556,7 +556,7 @@ function x509_verify%(certs: x509_opaque_vector, root_certs: table_string_of_str
 			}
 
 		int num_certs = sk_X509_num(chain);
-		chainVector = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("x509_opaque_vector"));
+		chainVector = zeek::make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("x509_opaque_vector"));
 
 		for ( int i = 0; i < num_certs; i++ )
 			{
@@ -564,7 +564,7 @@ function x509_verify%(certs: x509_opaque_vector, root_certs: table_string_of_str
 
 			if ( currcert )
 				// X509Val takes ownership of currcert.
-				chainVector->Assign(i, make_intrusive<file_analysis::X509Val>(currcert));
+				chainVector->Assign(i, zeek::make_intrusive<file_analysis::X509Val>(currcert));
 			else
 				{
 				reporter->InternalWarning("OpenSSL returned null certificate");
@@ -761,7 +761,7 @@ sct_verify_err:
  * 1 -> issuer name
  * 2 -> pubkey
  */
-IntrusivePtr<StringVal> x509_entity_hash(file_analysis::X509Val *cert_handle, unsigned int hash_alg, unsigned int type)
+zeek::IntrusivePtr<StringVal> x509_entity_hash(file_analysis::X509Val *cert_handle, unsigned int hash_alg, unsigned int type)
 	{
 	assert(cert_handle);
 
@@ -824,7 +824,7 @@ IntrusivePtr<StringVal> x509_entity_hash(file_analysis::X509Val *cert_handle, un
 
 	assert( len <= sizeof(md) );
 
-	return make_intrusive<StringVal>(len, reinterpret_cast<const char*>(md));
+	return zeek::make_intrusive<StringVal>(len, reinterpret_cast<const char*>(md));
 	}
 %%}
 
@@ -900,7 +900,7 @@ function x509_spki_hash%(cert: opaque of x509, hash_alg: count%): string
 ## .. zeek:see:: x509_set_certificate_cache_hit_callback
 function x509_set_certificate_cache%(tbl: string_any_table%) : bool
 	%{
-	file_analysis::X509::SetCertificateCache({NewRef{}, tbl->AsTableVal()});
+	file_analysis::X509::SetCertificateCache({zeek::NewRef{}, tbl->AsTableVal()});
 
 	return val_mgr->True();
 	%}
@@ -918,7 +918,7 @@ function x509_set_certificate_cache%(tbl: string_any_table%) : bool
 ## .. zeek:see:: x509_set_certificate_cache
 function x509_set_certificate_cache_hit_callback%(f: string_any_file_hook%) : bool
 	%{
-	file_analysis::X509::SetCertificateCacheHitCallback({NewRef{}, f->AsFunc()});
+	file_analysis::X509::SetCertificateCacheHitCallback({zeek::NewRef{}, f->AsFunc()});
 
 	return val_mgr->True();
 	%}
diff --git a/src/file_analysis/analyzer/x509/x509-extension.pac b/src/file_analysis/analyzer/x509/x509-extension.pac
index 9aaf095b71..3eeed377ae 100644
--- a/src/file_analysis/analyzer/x509/x509-extension.pac
+++ b/src/file_analysis/analyzer/x509/x509-extension.pac
@@ -41,11 +41,11 @@ refine connection MockConnection += {
 		mgr.Enqueue(x509_ocsp_ext_signed_certificate_timestamp,
 			bro_analyzer()->GetFile()->ToVal(),
 			val_mgr->Count(version),
-			make_intrusive<StringVal>(logid.length(), reinterpret_cast<const char*>(logid.begin())),
+			zeek::make_intrusive<StringVal>(logid.length(), reinterpret_cast<const char*>(logid.begin())),
 			val_mgr->Count(timestamp),
 			val_mgr->Count(digitally_signed_algorithms->HashAlgorithm()),
 			val_mgr->Count(digitally_signed_algorithms->SignatureAlgorithm()),
-			make_intrusive<StringVal>(digitally_signed_signature.length(), reinterpret_cast<const char*>(digitally_signed_signature.begin()))
+			zeek::make_intrusive<StringVal>(digitally_signed_signature.length(), reinterpret_cast<const char*>(digitally_signed_signature.begin()))
 			);
 
 		return true;
diff --git a/src/file_analysis/file_analysis.bif b/src/file_analysis/file_analysis.bif
index 7f60bc2845..26956a0b11 100644
--- a/src/file_analysis/file_analysis.bif
+++ b/src/file_analysis/file_analysis.bif
@@ -70,8 +70,8 @@ function Files::__stop%(file_id: string%): bool
 ## :zeek:see:`Files::analyzer_name`.
 function Files::__analyzer_name%(tag: Files::Tag%) : string
 	%{
-	const auto& n = file_mgr->GetComponentName(IntrusivePtr{NewRef{}, tag->AsEnumVal()});
-	return make_intrusive<StringVal>(n);
+	const auto& n = file_mgr->GetComponentName(zeek::IntrusivePtr{zeek::NewRef{}, tag->AsEnumVal()});
+	return zeek::make_intrusive<StringVal>(n);
 	%}
 
 ## :zeek:see:`Files::file_exists`.
diff --git a/src/input/Manager.cc b/src/input/Manager.cc
index f4fa7ea7e5..624a6e7834 100644
--- a/src/input/Manager.cc
+++ b/src/input/Manager.cc
@@ -472,7 +472,7 @@ bool Manager::CreateTableStream(RecordVal* fval)
 	auto idx_val = fval->GetFieldOrDefault("idx");
 	zeek::RecordType* idx = idx_val->AsType()->AsTypeType()->GetType()->AsRecordType();
 
-	IntrusivePtr<zeek::RecordType> val;
+	zeek::IntrusivePtr<zeek::RecordType> val;
 	auto val_val = fval->GetFieldOrDefault("val");
 
 	if ( val_val )
@@ -929,7 +929,7 @@ bool Manager::UnrollRecordType(vector<Field*> *fields, const zeek::RecordType *r
 			{
 			string name = nameprepend + rec->FieldName(i);
 			const char* secondary = nullptr;
-			IntrusivePtr<Val> c;
+			zeek::IntrusivePtr<Val> c;
 			zeek::TypeTag ty = rec->GetFieldType(i)->Tag();
 			zeek::TypeTag st = zeek::TYPE_VOID;
 			bool optional = false;
@@ -991,7 +991,7 @@ bool Manager::ForceUpdate(const string &name)
 
 Val* Manager::RecordValToIndexVal(RecordVal *r) const
 	{
-	IntrusivePtr<Val> idxval;
+	zeek::IntrusivePtr<Val> idxval;
 
 	zeek::RecordType *type = r->GetType()->AsRecordType();
 
@@ -1002,7 +1002,7 @@ Val* Manager::RecordValToIndexVal(RecordVal *r) const
 
 	else
 		{
-		auto l = make_intrusive<ListVal>(zeek::TYPE_ANY);
+		auto l = zeek::make_intrusive<ListVal>(zeek::TYPE_ANY);
 		for ( int j = 0 ; j < num_fields; j++ )
 			l->Append(r->GetFieldOrDefault(j));
 
@@ -1031,11 +1031,11 @@ Val* Manager::ValueToIndexVal(const Stream* i, int num_fields, const zeek::Recor
 		for ( int j = 0 ; j < type->NumFields(); j++ )
 			{
 			if ( type->GetFieldType(j)->Tag() == zeek::TYPE_RECORD )
-				l->Append({AdoptRef{}, ValueToRecordVal(i, vals,
+				l->Append({zeek::AdoptRef{}, ValueToRecordVal(i, vals,
 				          type->GetFieldType(j)->AsRecordType(), &position, have_error)});
 			else
 				{
-				l->Append({AdoptRef{}, ValueToVal(i, vals[position], type->GetFieldType(j).get(), have_error)});
+				l->Append({zeek::AdoptRef{}, ValueToVal(i, vals[position], type->GetFieldType(j).get(), have_error)});
 				position++;
 				}
 			}
@@ -1159,7 +1159,7 @@ int Manager::SendEntryTable(Stream* i, const Value* const *vals)
 	// call stream first to determine if we really add / change the entry
 	if ( stream->pred && ! convert_error )
 		{
-		IntrusivePtr<EnumVal> ev;
+		zeek::IntrusivePtr<EnumVal> ev;
 		int startpos = 0;
 		bool pred_convert_error = false;
 		predidx = ValueToRecordVal(i, vals, stream->itype, &startpos, pred_convert_error);
@@ -1230,12 +1230,12 @@ int Manager::SendEntryTable(Stream* i, const Value* const *vals)
 
 	assert(idxval);
 
-	IntrusivePtr<Val> oldval;
+	zeek::IntrusivePtr<Val> oldval;
 	if ( updated == true )
 		{
 		assert(stream->num_val_fields > 0);
 		// in that case, we need the old value to send the event (if we send an event).
-		oldval = stream->tab->Find({NewRef{}, idxval});
+		oldval = stream->tab->Find({zeek::NewRef{}, idxval});
 		}
 
 	auto k = stream->tab->MakeHashKey(*idxval);
@@ -1247,7 +1247,7 @@ int Manager::SendEntryTable(Stream* i, const Value* const *vals)
 	ih->idxkey = new HashKey(k->Key(), k->Size(), k->Hash());
 	ih->valhash = valhash;
 
-	stream->tab->Assign({AdoptRef{}, idxval}, std::move(k), {AdoptRef{}, valval});
+	stream->tab->Assign({zeek::AdoptRef{}, idxval}, std::move(k), {zeek::AdoptRef{}, valval});
 
 	if ( predidx != nullptr )
 		Unref(predidx);
@@ -1326,9 +1326,9 @@ void Manager::EndCurrentSend(ReaderFrontend* reader)
 
 	while ( ( ih = stream->lastDict->NextEntry(lastDictIdxKey, c) ) )
 		{
-		IntrusivePtr<Val> val;
-		IntrusivePtr<Val> predidx;
-		IntrusivePtr<EnumVal> ev;
+		zeek::IntrusivePtr<Val> val;
+		zeek::IntrusivePtr<Val> predidx;
+		zeek::IntrusivePtr<EnumVal> ev;
 		int startpos = 0;
 
 		if ( stream->pred || stream->event )
@@ -1337,7 +1337,7 @@ void Manager::EndCurrentSend(ReaderFrontend* reader)
 			assert(idx != nullptr);
 			val = stream->tab->FindOrDefault(idx);
 			assert(val != nullptr);
-			predidx = {AdoptRef{}, ListValToRecordVal(idx.get(), stream->itype, &startpos)};
+			predidx = {zeek::AdoptRef{}, ListValToRecordVal(idx.get(), stream->itype, &startpos)};
 			ev = zeek::BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_REMOVED);
 			}
 
@@ -1541,12 +1541,12 @@ int Manager::PutTable(Stream* i, const Value* const *vals)
 	if ( stream->pred || stream->event )
 		{
 		bool updated = false;
-		IntrusivePtr<Val> oldval;
+		zeek::IntrusivePtr<Val> oldval;
 
 		if ( stream->num_val_fields > 0 )
 			{
 			// in that case, we need the old value to send the event (if we send an event).
-			oldval = stream->tab->Find({NewRef{}, idxval});
+			oldval = stream->tab->Find({zeek::NewRef{}, idxval});
 			}
 
 		if ( oldval != nullptr )
@@ -1559,7 +1559,7 @@ int Manager::PutTable(Stream* i, const Value* const *vals)
 		// predicate if we want the update or not
 		if ( stream->pred )
 			{
-			IntrusivePtr<EnumVal> ev;
+			zeek::IntrusivePtr<EnumVal> ev;
 			int startpos = 0;
 			bool pred_convert_error = false;
 			Val* predidx = ValueToRecordVal(i, vals, stream->itype, &startpos, pred_convert_error);
@@ -1593,7 +1593,7 @@ int Manager::PutTable(Stream* i, const Value* const *vals)
 
 			}
 
-		stream->tab->Assign({NewRef{}, idxval}, {AdoptRef{}, valval});
+		stream->tab->Assign({zeek::NewRef{}, idxval}, {zeek::AdoptRef{}, valval});
 
 		if ( stream->event )
 			{
@@ -1631,7 +1631,7 @@ int Manager::PutTable(Stream* i, const Value* const *vals)
 		}
 
 	else // no predicates or other stuff
-		stream->tab->Assign({NewRef{}, idxval}, {AdoptRef{}, valval});
+		stream->tab->Assign({zeek::NewRef{}, idxval}, {zeek::AdoptRef{}, valval});
 
 	Unref(idxval); // not consumed by assign
 
@@ -1690,7 +1690,7 @@ bool Manager::Delete(ReaderFrontend* reader, Value* *vals)
 
 		if ( stream->pred || stream->event )
 			{
-			auto val = stream->tab->FindOrDefault({NewRef{}, idxval});
+			auto val = stream->tab->FindOrDefault({zeek::NewRef{}, idxval});
 
 			if ( stream->pred )
 				{
@@ -1703,7 +1703,7 @@ bool Manager::Delete(ReaderFrontend* reader, Value* *vals)
 					{
 					auto ev = zeek::BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_REMOVED);
 
-					streamresult = CallPred(stream->pred, 3, ev.release(), predidx, IntrusivePtr{val}.release());
+					streamresult = CallPred(stream->pred, 3, ev.release(), predidx, zeek::IntrusivePtr{val}.release());
 
 					if ( streamresult == false )
 						{
@@ -1721,7 +1721,7 @@ bool Manager::Delete(ReaderFrontend* reader, Value* *vals)
 				Ref(idxval);
 				assert(val != nullptr);
 				auto ev = zeek::BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_REMOVED);
-				SendEvent(stream->event, 4, stream->description->Ref(), ev.release(), idxval, IntrusivePtr{val}.release());
+				SendEvent(stream->event, 4, stream->description->Ref(), ev.release(), idxval, zeek::IntrusivePtr{val}.release());
 				}
 			}
 
@@ -1765,7 +1765,7 @@ bool Manager::CallPred(Func* pred_func, const int numvals, ...) const
 	va_list lP;
 	va_start(lP, numvals);
 	for ( int i = 0; i < numvals; i++ )
-		vl.emplace_back(AdoptRef{}, va_arg(lP, Val*));
+		vl.emplace_back(zeek::AdoptRef{}, va_arg(lP, Val*));
 
 	va_end(lP);
 
@@ -1790,7 +1790,7 @@ void Manager::SendEvent(EventHandlerPtr ev, const int numvals, ...) const
 	va_list lP;
 	va_start(lP, numvals);
 	for ( int i = 0; i < numvals; i++ )
-		vl.emplace_back(AdoptRef{}, va_arg(lP, Val*));
+		vl.emplace_back(zeek::AdoptRef{}, va_arg(lP, Val*));
 
 	va_end(lP);
 
@@ -1809,7 +1809,7 @@ void Manager::SendEvent(EventHandlerPtr ev, list<Val*> events) const
 #endif
 
 	for ( list<Val*>::iterator i = events.begin(); i != events.end(); i++ )
-		vl.emplace_back(AdoptRef{}, *i);
+		vl.emplace_back(zeek::AdoptRef{}, *i);
 
 	if ( ev )
 		mgr.Enqueue(ev, std::move(vl), SOURCE_LOCAL);
@@ -1821,7 +1821,7 @@ RecordVal* Manager::ListValToRecordVal(ListVal* list, zeek::RecordType *request_
 	{
 	assert(position != nullptr); // we need the pointer to point to data;
 
-	RecordVal* rec = new RecordVal({NewRef{}, request_type});
+	RecordVal* rec = new RecordVal({zeek::NewRef{}, request_type});
 
 	assert(list != nullptr);
 	int maxpos = list->Length();
@@ -1839,7 +1839,7 @@ RecordVal* Manager::ListValToRecordVal(ListVal* list, zeek::RecordType *request_
 			(*position)++;
 			}
 
-		rec->Assign(i, {NewRef{}, fieldVal});
+		rec->Assign(i, {zeek::NewRef{}, fieldVal});
 		}
 
 	return rec;
@@ -1851,7 +1851,7 @@ RecordVal* Manager::ValueToRecordVal(const Stream* stream, const Value* const *v
 	{
 	assert(position != nullptr); // we need the pointer to point to data.
 
-	RecordVal* rec = new RecordVal({NewRef{}, request_type});
+	RecordVal* rec = new RecordVal({zeek::NewRef{}, request_type});
 	for ( int i = 0; i < request_type->NumFields(); i++ )
 		{
 		Val* fieldVal = nullptr;
@@ -1876,7 +1876,7 @@ RecordVal* Manager::ValueToRecordVal(const Stream* stream, const Value* const *v
 			}
 
 		if ( fieldVal )
-			rec->Assign(i, {AdoptRef{}, fieldVal});
+			rec->Assign(i, {zeek::AdoptRef{}, fieldVal});
 		}
 
 	return rec;
@@ -2255,15 +2255,15 @@ Val* Manager::ValueToVal(const Stream* i, const Value* val, zeek::Type* request_
 		{
 		// all entries have to have the same type...
 		const auto& type = request_type->AsTableType()->GetIndices()->GetPureType();
-		auto set_index = make_intrusive<zeek::TypeList>(type);
+		auto set_index = zeek::make_intrusive<zeek::TypeList>(type);
 		set_index->Append(type);
-		auto s = make_intrusive<zeek::SetType>(std::move(set_index), nullptr);
+		auto s = zeek::make_intrusive<zeek::SetType>(std::move(set_index), nullptr);
 		TableVal* t = new TableVal(std::move(s));
 		for ( int j = 0; j < val->val.set_val.size; j++ )
 			{
 			Val* assignval = ValueToVal(i, val->val.set_val.vals[j], type.get(), have_error);
 
-			t->Assign({AdoptRef{}, assignval}, nullptr);
+			t->Assign({zeek::AdoptRef{}, assignval}, nullptr);
 			}
 
 		return t;
@@ -2273,13 +2273,13 @@ Val* Manager::ValueToVal(const Stream* i, const Value* val, zeek::Type* request_
 		{
 		// all entries have to have the same type...
 		const auto& type = request_type->AsVectorType()->Yield();
-		auto vt = make_intrusive<zeek::VectorType>(type);
-		auto v = make_intrusive<VectorVal>(std::move(vt));
+		auto vt = zeek::make_intrusive<zeek::VectorType>(type);
+		auto v = zeek::make_intrusive<VectorVal>(std::move(vt));
 
 		for ( int j = 0; j < val->val.vector_val.size; j++ )
 			{
 			auto el = ValueToVal(i, val->val.vector_val.vals[j], type.get(), have_error);
-			v->Assign(j, {AdoptRef{}, el});
+			v->Assign(j, {zeek::AdoptRef{}, el});
 			}
 
 		return v.release();
@@ -2435,7 +2435,7 @@ void Manager::ErrorHandler(const Stream* i, ErrorType et, bool reporter_send, co
 	// send our script level error event
 	if ( i->error_event )
 		{
-		IntrusivePtr<EnumVal> ev;
+		zeek::IntrusivePtr<EnumVal> ev;
 		switch (et)
 			{
 			case ErrorType::INFO:
diff --git a/src/input/Tag.cc b/src/input/Tag.cc
index cbdcd59aae..00dd51811e 100644
--- a/src/input/Tag.cc
+++ b/src/input/Tag.cc
@@ -16,7 +16,7 @@ input::Tag& input::Tag::operator=(const input::Tag& other)
 	return *this;
 	}
 
-const IntrusivePtr<EnumVal>& input::Tag::AsVal() const
+const zeek::IntrusivePtr<EnumVal>& input::Tag::AsVal() const
 	{
 	return ::Tag::AsVal(input_mgr->GetTagType());
 	}
@@ -26,10 +26,10 @@ EnumVal* input::Tag::AsEnumVal() const
 	return AsVal().get();
 	}
 
-input::Tag::Tag(IntrusivePtr<EnumVal> val)
+input::Tag::Tag(zeek::IntrusivePtr<EnumVal> val)
 	: ::Tag(std::move(val))
 	{ }
 
 input::Tag::Tag(EnumVal* val)
-	: ::Tag({NewRef{}, val})
+	: ::Tag({zeek::NewRef{}, val})
 	{ }
diff --git a/src/input/Tag.h b/src/input/Tag.h
index b4aa4b11f7..1ed52e34ad 100644
--- a/src/input/Tag.h
+++ b/src/input/Tag.h
@@ -89,7 +89,7 @@ public:
 	 *
 	 * @param etype the script-layer enum type associated with the tag.
 	 */
-	const IntrusivePtr<EnumVal>& AsVal() const;
+	const zeek::IntrusivePtr<EnumVal>& AsVal() const;
 
 	[[deprecated("Remove in v4.1.  Use AsVal() instead.")]]
 	EnumVal* AsEnumVal() const;
@@ -117,7 +117,7 @@ protected:
 	 *
 	 * @param val An enum value of script type \c Input::Reader.
 	 */
-	explicit Tag(IntrusivePtr<EnumVal> val);
+	explicit Tag(zeek::IntrusivePtr<EnumVal> val);
 
 	[[deprecated("Remove in v4.1.  Construct from IntrusivePtr isntead.")]]
 	explicit Tag(EnumVal* val);
diff --git a/src/iosource/Packet.cc b/src/iosource/Packet.cc
index 1843868f10..654969c0ce 100644
--- a/src/iosource/Packet.cc
+++ b/src/iosource/Packet.cc
@@ -592,12 +592,12 @@ void Packet::ProcessLayer2()
 	hdr_size = (pdata - data);
 }
 
-IntrusivePtr<RecordVal> Packet::ToRawPktHdrVal() const
+zeek::IntrusivePtr<RecordVal> Packet::ToRawPktHdrVal() const
 	{
 	static auto raw_pkt_hdr_type = zeek::id::find_type<zeek::RecordType>("raw_pkt_hdr");
 	static auto l2_hdr_type = zeek::id::find_type<zeek::RecordType>("l2_hdr");
-	auto pkt_hdr = make_intrusive<RecordVal>(raw_pkt_hdr_type);
-	auto l2_hdr = make_intrusive<RecordVal>(l2_hdr_type);
+	auto pkt_hdr = zeek::make_intrusive<RecordVal>(raw_pkt_hdr_type);
+	auto l2_hdr = zeek::make_intrusive<RecordVal>(l2_hdr_type);
 
 	bool is_ethernet = link_type == DLT_EN10MB;
 
@@ -674,12 +674,12 @@ RecordVal* Packet::BuildPktHdrVal() const
 	return ToRawPktHdrVal().release();
 	}
 
-IntrusivePtr<Val> Packet::FmtEUI48(const u_char* mac) const
+zeek::IntrusivePtr<Val> Packet::FmtEUI48(const u_char* mac) const
 	{
 	char buf[20];
 	snprintf(buf, sizeof buf, "%02x:%02x:%02x:%02x:%02x:%02x",
 		 mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
-	return make_intrusive<StringVal>(buf);
+	return zeek::make_intrusive<StringVal>(buf);
 	}
 
 void Packet::Describe(ODesc* d) const
diff --git a/src/iosource/Packet.h b/src/iosource/Packet.h
index 83b0fddb59..6f96c7a06b 100644
--- a/src/iosource/Packet.h
+++ b/src/iosource/Packet.h
@@ -1,3 +1,4 @@
+
 #pragma once
 
 #include <string>
@@ -16,7 +17,10 @@ class Val;
 class ODesc;
 class IP_Hdr;
 class RecordVal;
+
+namespace zeek {
 template <class T> class IntrusivePtr;
+}
 
 /**
  * The Layer 3 type of a packet, as determined by the parsing code in Packet.
@@ -128,7 +132,7 @@ public:
 	 * Returns a \c raw_pkt_hdr RecordVal, which includes layer 2 and
 	 * also everything in IP_Hdr (i.e., IP4/6 + TCP/UDP/ICMP).
 	 */
-	IntrusivePtr<RecordVal> ToRawPktHdrVal() const;
+	zeek::IntrusivePtr<RecordVal> ToRawPktHdrVal() const;
 
 	[[deprecated("Remove in v4.1.  Use ToRawPktHdrval() instead.")]]
 	RecordVal* BuildPktHdrVal() const;
@@ -225,7 +229,7 @@ private:
 	void Weird(const char* name);
 
 	// Renders an MAC address into its ASCII representation.
-	IntrusivePtr<Val> FmtEUI48(const u_char* mac) const;
+	zeek::IntrusivePtr<Val> FmtEUI48(const u_char* mac) const;
 
 	// True if we need to delete associated packet memory upon
 	// destruction.
diff --git a/src/iosource/pcap/Source.cc b/src/iosource/pcap/Source.cc
index 897cea0f25..b29a096c2e 100644
--- a/src/iosource/pcap/Source.cc
+++ b/src/iosource/pcap/Source.cc
@@ -47,7 +47,7 @@ void PcapSource::Close()
 	Closed();
 
 	if ( Pcap::file_done )
-		mgr.Enqueue(Pcap::file_done, make_intrusive<StringVal>(props.path));
+		mgr.Enqueue(Pcap::file_done, zeek::make_intrusive<StringVal>(props.path));
 	}
 
 void PcapSource::OpenLive()
diff --git a/src/iosource/pcap/pcap.bif b/src/iosource/pcap/pcap.bif
index fd4dbd60fe..11bc904af8 100644
--- a/src/iosource/pcap/pcap.bif
+++ b/src/iosource/pcap/pcap.bif
@@ -96,8 +96,8 @@ function error%(%): string
 		{
 		const char* err = ps->ErrorMsg();
 		if ( *err )
-			return make_intrusive<StringVal>(err);
+			return zeek::make_intrusive<StringVal>(err);
 		}
 
-	return make_intrusive<StringVal>("no error");
+	return zeek::make_intrusive<StringVal>("no error");
 	%}
diff --git a/src/logging/Manager.cc b/src/logging/Manager.cc
index cff56c63d0..d72deaf8eb 100644
--- a/src/logging/Manager.cc
+++ b/src/logging/Manager.cc
@@ -476,7 +476,7 @@ bool Manager::TraverseRecord(Stream* stream, Filter* filter, zeek::RecordType* r
 		// If include fields are specified, only include if explicitly listed.
 		if ( include )
 			{
-			auto new_path_val = make_intrusive<StringVal>(new_path.c_str());
+			auto new_path_val = zeek::make_intrusive<StringVal>(new_path.c_str());
 			bool result = (bool)include->FindOrDefault(new_path_val);
 
 			if ( ! result )
@@ -486,7 +486,7 @@ bool Manager::TraverseRecord(Stream* stream, Filter* filter, zeek::RecordType* r
 		// If exclude fields are specified, do not only include if listed.
 		if ( exclude )
 			{
-			auto new_path_val = make_intrusive<StringVal>(new_path.c_str());
+			auto new_path_val = zeek::make_intrusive<StringVal>(new_path.c_str());
 			bool result = (bool)exclude->FindOrDefault(new_path_val);
 
 			if ( result )
@@ -695,7 +695,7 @@ bool Manager::Write(EnumVal* id, RecordVal* columns_arg)
 	if ( ! stream->enabled )
 		return true;
 
-	auto columns = columns_arg->CoerceTo({NewRef{}, stream->columns});
+	auto columns = columns_arg->CoerceTo({zeek::NewRef{}, stream->columns});
 
 	if ( ! columns )
 		{
@@ -730,23 +730,23 @@ bool Manager::Write(EnumVal* id, RecordVal* columns_arg)
 
 		if ( filter->path_func )
 			{
-			IntrusivePtr<Val> path_arg;
+			zeek::IntrusivePtr<Val> path_arg;
 
 			if ( filter->path_val )
-				path_arg = {NewRef{}, filter->path_val};
+				path_arg = {zeek::NewRef{}, filter->path_val};
 			else
 				path_arg = val_mgr->EmptyString();
 
-			IntrusivePtr<Val> rec_arg;
+			zeek::IntrusivePtr<Val> rec_arg;
 			const auto& rt = filter->path_func->GetType()->Params()->GetFieldType("rec");
 
 			if ( rt->Tag() == zeek::TYPE_RECORD )
-				rec_arg = columns->CoerceTo(cast_intrusive<zeek::RecordType>(rt), true);
+				rec_arg = columns->CoerceTo(zeek::cast_intrusive<zeek::RecordType>(rt), true);
 			else
 				// Can be TYPE_ANY here.
 				rec_arg = columns;
 
-			auto v = filter->path_func->Invoke(IntrusivePtr{NewRef{}, id},
+			auto v = filter->path_func->Invoke(zeek::IntrusivePtr{zeek::NewRef{}, id},
 			                                   std::move(path_arg),
 			                                   std::move(rec_arg));
 
@@ -842,7 +842,7 @@ bool Manager::Write(EnumVal* id, RecordVal* columns_arg)
 				if ( filter->field_name_map )
 					{
 					const char* name = filter->fields[j]->name;
-					auto fn = make_intrusive<StringVal>(name);
+					auto fn = zeek::make_intrusive<StringVal>(name);
 
 					if ( const auto& val = filter->field_name_map->Find(fn) )
 						{
@@ -1010,7 +1010,7 @@ threading::Value* Manager::ValToLogVal(Val* val, zeek::Type* ty)
 		if ( ! set )
 			// ToPureListVal has reported an internal warning
 			// already. Just keep going by making something up.
-			set = make_intrusive<ListVal>(zeek::TYPE_INT);
+			set = zeek::make_intrusive<ListVal>(zeek::TYPE_INT);
 
 		lval->val.set_val.size = set->Length();
 		lval->val.set_val.vals = new threading::Value* [lval->val.set_val.size];
@@ -1048,14 +1048,14 @@ threading::Value* Manager::ValToLogVal(Val* val, zeek::Type* ty)
 threading::Value** Manager::RecordToFilterVals(Stream* stream, Filter* filter,
                                                RecordVal* columns)
 	{
-	IntrusivePtr<RecordVal> ext_rec;
+	zeek::IntrusivePtr<RecordVal> ext_rec;
 
 	if ( filter->num_ext_fields > 0 )
 		{
-		auto res = filter->ext_func->Invoke(IntrusivePtr{NewRef{}, filter->path_val});
+		auto res = filter->ext_func->Invoke(zeek::IntrusivePtr{zeek::NewRef{}, filter->path_val});
 
 		if ( res )
-			ext_rec = {AdoptRef{}, res.release()->AsRecordVal()};
+			ext_rec = {zeek::AdoptRef{}, res.release()->AsRecordVal()};
 		}
 
 	threading::Value** vals = new threading::Value*[filter->num_fields];
@@ -1508,12 +1508,12 @@ bool Manager::FinishedRotation(WriterFrontend* writer, const char* new_name, con
 		return true;
 
 	// Create the RotationInfo record.
-	auto info = make_intrusive<RecordVal>(zeek::BifType::Record::Log::RotationInfo);
-	info->Assign(0, {NewRef{}, winfo->type});
-	info->Assign(1, make_intrusive<StringVal>(new_name));
-	info->Assign(2, make_intrusive<StringVal>(winfo->writer->Info().path));
-	info->Assign(3, make_intrusive<TimeVal>(open));
-	info->Assign(4, make_intrusive<TimeVal>(close));
+	auto info = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::Log::RotationInfo);
+	info->Assign(0, {zeek::NewRef{}, winfo->type});
+	info->Assign(1, zeek::make_intrusive<StringVal>(new_name));
+	info->Assign(2, zeek::make_intrusive<StringVal>(winfo->writer->Info().path));
+	info->Assign(3, zeek::make_intrusive<TimeVal>(open));
+	info->Assign(4, zeek::make_intrusive<TimeVal>(close));
 	info->Assign(5, val_mgr->Bool(terminating));
 
 	Func* func = winfo->postprocessor;
diff --git a/src/logging/Tag.cc b/src/logging/Tag.cc
index 69d9e0ad67..6058758035 100644
--- a/src/logging/Tag.cc
+++ b/src/logging/Tag.cc
@@ -22,7 +22,7 @@ logging::Tag& logging::Tag::operator=(const logging::Tag&& other) noexcept
 	return *this;
 	}
 
-const IntrusivePtr<EnumVal>& logging::Tag::AsVal() const
+const zeek::IntrusivePtr<EnumVal>& logging::Tag::AsVal() const
 	{
 	return ::Tag::AsVal(log_mgr->GetTagType());
 	}
@@ -32,10 +32,10 @@ EnumVal* logging::Tag::AsEnumVal() const
 	return AsVal().get();
 	}
 
-logging::Tag::Tag(IntrusivePtr<EnumVal> val)
+logging::Tag::Tag(zeek::IntrusivePtr<EnumVal> val)
 	: ::Tag(std::move(val))
 	{ }
 
 logging::Tag::Tag(EnumVal* val)
-	: ::Tag({NewRef{}, val})
+	: ::Tag({zeek::NewRef{}, val})
 	{ }
diff --git a/src/logging/Tag.h b/src/logging/Tag.h
index 01cfb4b04e..b7f5430036 100644
--- a/src/logging/Tag.h
+++ b/src/logging/Tag.h
@@ -94,7 +94,7 @@ public:
 	 *
 	 * @param etype the script-layer enum type associated with the tag.
 	 */
-	const IntrusivePtr<EnumVal>& AsVal() const;
+	const zeek::IntrusivePtr<EnumVal>& AsVal() const;
 
 	[[deprecated("Remove in v4.1.  Use AsVal() instead.")]]
 	EnumVal* AsEnumVal() const;
@@ -122,7 +122,7 @@ protected:
 	 *
 	 * @param val An enum value of script type \c Log::Writer.
 	 */
-	explicit Tag(IntrusivePtr<EnumVal> val);
+	explicit Tag(zeek::IntrusivePtr<EnumVal> val);
 
 	[[deprecated("Remove in v4.1.  Construct from IntrusivePtr instead.")]]
 	explicit Tag(EnumVal* val);
diff --git a/src/option.bif b/src/option.bif
index 8d5daa9878..af24ce698f 100644
--- a/src/option.bif
+++ b/src/option.bif
@@ -7,8 +7,8 @@ module Option;
 #include "NetVar.h"
 #include "broker/Data.h"
 
-static bool call_option_handlers_and_set_value(StringVal* name, const IntrusivePtr<zeek::detail::ID>& i,
-                                               IntrusivePtr<Val> val,
+static bool call_option_handlers_and_set_value(StringVal* name, const zeek::IntrusivePtr<zeek::detail::ID>& i,
+                                               zeek::IntrusivePtr<Val> val,
                                                StringVal* location)
 	{
 	if ( i->HasOptionHandlers() )
@@ -18,11 +18,11 @@ static bool call_option_handlers_and_set_value(StringVal* name, const IntrusiveP
 			bool add_loc = handler_function->GetType()->ParamList()->GetTypes().size() == 3;
 			zeek::Args vl;
 			vl.reserve(2 + add_loc);
-			vl.emplace_back(NewRef{}, name);
+			vl.emplace_back(zeek::NewRef{}, name);
 			vl.emplace_back(val);
 
 			if ( add_loc )
-				vl.emplace_back(NewRef{}, location);
+				vl.emplace_back(zeek::NewRef{}, location);
 
 			val = handler_function->Invoke(&vl); // consumed by next call.
 
@@ -102,8 +102,8 @@ function Option::set%(ID: string, val: any, location: string &default=""%): bool
 		     val->GetType()->AsTableType()->IsUnspecifiedTable() )
 			{
 			// Just coerce an empty/unspecified table to the right type.
-			auto tv = make_intrusive<TableVal>(
-			        cast_intrusive<TableType>(i->GetType()),
+			auto tv = zeek::make_intrusive<TableVal>(
+			        zeek::cast_intrusive<TableType>(i->GetType()),
 			        i->GetVal()->AsTableVal()->GetAttrs());
 			auto rval = call_option_handlers_and_set_value(ID, i, std::move(tv), location);
 			return val_mgr->Bool(rval);
@@ -114,7 +114,7 @@ function Option::set%(ID: string, val: any, location: string &default=""%): bool
 		return val_mgr->False();
 		}
 
-	auto rval = call_option_handlers_and_set_value(ID, i, {NewRef{}, val}, location);
+	auto rval = call_option_handlers_and_set_value(ID, i, {zeek::NewRef{}, val}, location);
 	return val_mgr->Bool(rval);
 	%}
 
diff --git a/src/parse.y b/src/parse.y
index afbea2aea0..5b963af194 100644
--- a/src/parse.y
+++ b/src/parse.y
@@ -167,7 +167,7 @@ static void parser_redef_enum (zeek::detail::ID *id)
 	}
 
 static void extend_record(zeek::detail::ID* id, std::unique_ptr<zeek::type_decl_list> fields,
-                          std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>> attrs)
+                          std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>> attrs)
 	{
 	std::set<zeek::Type*> types = zeek::Type::GetAliases(id->Name());
 
@@ -199,14 +199,14 @@ static void extend_record(zeek::detail::ID* id, std::unique_ptr<zeek::type_decl_
 		}
 	}
 
-static IntrusivePtr<zeek::detail::Attributes>
-make_attributes(std::vector<IntrusivePtr<zeek::detail::Attr>>* attrs,
-                IntrusivePtr<zeek::Type> t, bool in_record, bool is_global)
+static zeek::IntrusivePtr<zeek::detail::Attributes>
+make_attributes(std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>* attrs,
+                zeek::IntrusivePtr<zeek::Type> t, bool in_record, bool is_global)
 	{
 	if ( ! attrs )
 		return nullptr;
 
-	auto rval = make_intrusive<zeek::detail::Attributes>(std::move(*attrs), std::move(t),
+	auto rval = zeek::make_intrusive<zeek::detail::Attributes>(std::move(*attrs), std::move(t),
 	                                       in_record, is_global);
 	delete attrs;
 	return rval;
@@ -250,7 +250,7 @@ static bool expr_is_table_type_name(const zeek::detail::Expr* expr)
 	zeek::detail::Case* c_case;
 	zeek::detail::case_list* case_l;
 	zeek::detail::Attr* attr;
-	std::vector<IntrusivePtr<zeek::detail::Attr>>* attr_l;
+	std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>* attr_l;
 	zeek::detail::AttrTag attrtag;
 }
 
@@ -300,157 +300,157 @@ expr:
 	|	TOK_COPY '(' expr ')'
 			{
 			set_location(@1, @4);
-			$$ = new zeek::detail::CloneExpr({AdoptRef{}, $3});
+			$$ = new zeek::detail::CloneExpr({zeek::AdoptRef{}, $3});
 			}
 
 	|	TOK_INCR expr
 			{
 			set_location(@1, @2);
-			$$ = new zeek::detail::IncrExpr(zeek::detail::EXPR_INCR, {AdoptRef{}, $2});
+			$$ = new zeek::detail::IncrExpr(zeek::detail::EXPR_INCR, {zeek::AdoptRef{}, $2});
 			}
 
 	|	TOK_DECR expr
 			{
 			set_location(@1, @2);
-			$$ = new zeek::detail::IncrExpr(zeek::detail::EXPR_DECR, {AdoptRef{}, $2});
+			$$ = new zeek::detail::IncrExpr(zeek::detail::EXPR_DECR, {zeek::AdoptRef{}, $2});
 			}
 
 	|	'!' expr
 			{
 			set_location(@1, @2);
-			$$ = new zeek::detail::NotExpr({AdoptRef{}, $2});
+			$$ = new zeek::detail::NotExpr({zeek::AdoptRef{}, $2});
 			}
 
 	|	'~' expr
 			{
 			set_location(@1, @2);
-			$$ = new zeek::detail::ComplementExpr({AdoptRef{}, $2});
+			$$ = new zeek::detail::ComplementExpr({zeek::AdoptRef{}, $2});
 			}
 
 	|	'-' expr	%prec '!'
 			{
 			set_location(@1, @2);
-			$$ = new zeek::detail::NegExpr({AdoptRef{}, $2});
+			$$ = new zeek::detail::NegExpr({zeek::AdoptRef{}, $2});
 			}
 
 	|	'+' expr	%prec '!'
 			{
 			set_location(@1, @2);
-			$$ = new zeek::detail::PosExpr({AdoptRef{}, $2});
+			$$ = new zeek::detail::PosExpr({zeek::AdoptRef{}, $2});
 			}
 
 	|	expr '+' expr
 			{
 			set_location(@1, @3);
-			$$ = new zeek::detail::AddExpr({AdoptRef{}, $1}, {AdoptRef{}, $3});
+			$$ = new zeek::detail::AddExpr({zeek::AdoptRef{}, $1}, {zeek::AdoptRef{}, $3});
 			}
 
 	|	expr TOK_ADD_TO expr
 			{
 			set_location(@1, @3);
-			$$ = new zeek::detail::AddToExpr({AdoptRef{}, $1}, {AdoptRef{}, $3});
+			$$ = new zeek::detail::AddToExpr({zeek::AdoptRef{}, $1}, {zeek::AdoptRef{}, $3});
 			}
 
 	|	expr '-' expr
 			{
 			set_location(@1, @3);
-			$$ = new zeek::detail::SubExpr({AdoptRef{}, $1}, {AdoptRef{}, $3});
+			$$ = new zeek::detail::SubExpr({zeek::AdoptRef{}, $1}, {zeek::AdoptRef{}, $3});
 			}
 
 	|	expr TOK_REMOVE_FROM expr
 			{
 			set_location(@1, @3);
-			$$ = new zeek::detail::RemoveFromExpr({AdoptRef{}, $1}, {AdoptRef{}, $3});
+			$$ = new zeek::detail::RemoveFromExpr({zeek::AdoptRef{}, $1}, {zeek::AdoptRef{}, $3});
 			}
 
 	|	expr '*' expr
 			{
 			set_location(@1, @3);
-			$$ = new zeek::detail::TimesExpr({AdoptRef{}, $1}, {AdoptRef{}, $3});
+			$$ = new zeek::detail::TimesExpr({zeek::AdoptRef{}, $1}, {zeek::AdoptRef{}, $3});
 			}
 
 	|	expr '/' expr
 			{
 			set_location(@1, @3);
-			$$ = new zeek::detail::DivideExpr({AdoptRef{}, $1}, {AdoptRef{}, $3});
+			$$ = new zeek::detail::DivideExpr({zeek::AdoptRef{}, $1}, {zeek::AdoptRef{}, $3});
 			}
 
 	|	expr '%' expr
 			{
 			set_location(@1, @3);
-			$$ = new zeek::detail::ModExpr({AdoptRef{}, $1}, {AdoptRef{}, $3});
+			$$ = new zeek::detail::ModExpr({zeek::AdoptRef{}, $1}, {zeek::AdoptRef{}, $3});
 			}
 
 	|	expr '&' expr
 			{
 			set_location(@1, @3);
-			$$ = new zeek::detail::BitExpr(zeek::detail::EXPR_AND, {AdoptRef{}, $1}, {AdoptRef{}, $3});
+			$$ = new zeek::detail::BitExpr(zeek::detail::EXPR_AND, {zeek::AdoptRef{}, $1}, {zeek::AdoptRef{}, $3});
 			}
 
 	|	expr '|' expr
 			{
 			set_location(@1, @3);
-			$$ = new zeek::detail::BitExpr(zeek::detail::EXPR_OR, {AdoptRef{}, $1}, {AdoptRef{}, $3});
+			$$ = new zeek::detail::BitExpr(zeek::detail::EXPR_OR, {zeek::AdoptRef{}, $1}, {zeek::AdoptRef{}, $3});
 			}
 
 	|	expr '^' expr
 			{
 			set_location(@1, @3);
-			$$ = new zeek::detail::BitExpr(zeek::detail::EXPR_XOR, {AdoptRef{}, $1}, {AdoptRef{}, $3});
+			$$ = new zeek::detail::BitExpr(zeek::detail::EXPR_XOR, {zeek::AdoptRef{}, $1}, {zeek::AdoptRef{}, $3});
 			}
 
 	|	expr TOK_AND_AND expr
 			{
 			set_location(@1, @3);
-			$$ = new zeek::detail::BoolExpr(zeek::detail::EXPR_AND_AND, {AdoptRef{}, $1}, {AdoptRef{}, $3});
+			$$ = new zeek::detail::BoolExpr(zeek::detail::EXPR_AND_AND, {zeek::AdoptRef{}, $1}, {zeek::AdoptRef{}, $3});
 			}
 
 	|	expr TOK_OR_OR expr
 			{
 			set_location(@1, @3);
-			$$ = new zeek::detail::BoolExpr(zeek::detail::EXPR_OR_OR, {AdoptRef{}, $1}, {AdoptRef{}, $3});
+			$$ = new zeek::detail::BoolExpr(zeek::detail::EXPR_OR_OR, {zeek::AdoptRef{}, $1}, {zeek::AdoptRef{}, $3});
 			}
 
 	|	expr TOK_EQ expr
 			{
 			set_location(@1, @3);
-			$$ = new zeek::detail::EqExpr(zeek::detail::EXPR_EQ, {AdoptRef{}, $1}, {AdoptRef{}, $3});
+			$$ = new zeek::detail::EqExpr(zeek::detail::EXPR_EQ, {zeek::AdoptRef{}, $1}, {zeek::AdoptRef{}, $3});
 			}
 
 	|	expr TOK_NE expr
 			{
 			set_location(@1, @3);
-			$$ = new zeek::detail::EqExpr(zeek::detail::EXPR_NE, {AdoptRef{}, $1}, {AdoptRef{}, $3});
+			$$ = new zeek::detail::EqExpr(zeek::detail::EXPR_NE, {zeek::AdoptRef{}, $1}, {zeek::AdoptRef{}, $3});
 			}
 
 	|	expr '<' expr
 			{
 			set_location(@1, @3);
-			$$ = new zeek::detail::RelExpr(zeek::detail::EXPR_LT, {AdoptRef{}, $1}, {AdoptRef{}, $3});
+			$$ = new zeek::detail::RelExpr(zeek::detail::EXPR_LT, {zeek::AdoptRef{}, $1}, {zeek::AdoptRef{}, $3});
 			}
 
 	|	expr TOK_LE expr
 			{
 			set_location(@1, @3);
-			$$ = new zeek::detail::RelExpr(zeek::detail::EXPR_LE, {AdoptRef{}, $1}, {AdoptRef{}, $3});
+			$$ = new zeek::detail::RelExpr(zeek::detail::EXPR_LE, {zeek::AdoptRef{}, $1}, {zeek::AdoptRef{}, $3});
 			}
 
 	|	expr '>' expr
 			{
 			set_location(@1, @3);
-			$$ = new zeek::detail::RelExpr(zeek::detail::EXPR_GT, {AdoptRef{}, $1}, {AdoptRef{}, $3});
+			$$ = new zeek::detail::RelExpr(zeek::detail::EXPR_GT, {zeek::AdoptRef{}, $1}, {zeek::AdoptRef{}, $3});
 			}
 
 	|	expr TOK_GE expr
 			{
 			set_location(@1, @3);
-			$$ = new zeek::detail::RelExpr(zeek::detail::EXPR_GE, {AdoptRef{}, $1}, {AdoptRef{}, $3});
+			$$ = new zeek::detail::RelExpr(zeek::detail::EXPR_GE, {zeek::AdoptRef{}, $1}, {zeek::AdoptRef{}, $3});
 			}
 
 	|	expr '?' expr ':' expr
 			{
 			set_location(@1, @5);
-			$$ = new zeek::detail::CondExpr({AdoptRef{}, $1}, {AdoptRef{}, $3}, {AdoptRef{}, $5});
+			$$ = new zeek::detail::CondExpr({zeek::AdoptRef{}, $1}, {zeek::AdoptRef{}, $3}, {zeek::AdoptRef{}, $5});
 			}
 
 	|	expr '=' expr
@@ -462,20 +462,20 @@ expr:
 				                " in arbitrary expression contexts, only"
 				                " as a statement");
 
-			$$ = zeek::detail::get_assign_expr({AdoptRef{}, $1}, {AdoptRef{}, $3}, in_init).release();
+			$$ = zeek::detail::get_assign_expr({zeek::AdoptRef{}, $1}, {zeek::AdoptRef{}, $3}, in_init).release();
 			}
 
 	|	TOK_LOCAL local_id '=' expr
 			{
 			set_location(@2, @4);
-			$$ = add_and_assign_local({AdoptRef{}, $2}, {AdoptRef{}, $4},
+			$$ = add_and_assign_local({zeek::AdoptRef{}, $2}, {zeek::AdoptRef{}, $4},
 			                          val_mgr->True()).release();
 			}
 
 	|	expr '[' expr_list ']'
 			{
 			set_location(@1, @4);
-			$$ = new zeek::detail::IndexExpr({AdoptRef{}, $1}, {AdoptRef{}, $3});
+			$$ = new zeek::detail::IndexExpr({zeek::AdoptRef{}, $1}, {zeek::AdoptRef{}, $3});
 			}
 
 	|	index_slice
@@ -483,13 +483,13 @@ expr:
 	|	expr '$' TOK_ID
 			{
 			set_location(@1, @3);
-			$$ = new zeek::detail::FieldExpr({AdoptRef{}, $1}, $3);
+			$$ = new zeek::detail::FieldExpr({zeek::AdoptRef{}, $1}, $3);
 			}
 
 	|	'$' TOK_ID '=' expr
 			{
 			set_location(@1, @4);
-			$$ = new zeek::detail::FieldAssignExpr($2, {AdoptRef{}, $4});
+			$$ = new zeek::detail::FieldAssignExpr($2, {zeek::AdoptRef{}, $4});
 			}
 
 	|	'$' TOK_ID func_params '='
@@ -499,25 +499,25 @@ expr:
 			func_id->SetInferReturnType(true);
 			begin_func(std::move(func_id), current_module.c_str(),
 		   	           zeek::FUNC_FLAVOR_FUNCTION, false,
-			           {AdoptRef{}, $3});
+			           {zeek::AdoptRef{}, $3});
 			}
 		 lambda_body
 			{
-			$$ = new zeek::detail::FieldAssignExpr($2, IntrusivePtr{AdoptRef{}, $6});
+			$$ = new zeek::detail::FieldAssignExpr($2, zeek::IntrusivePtr{zeek::AdoptRef{}, $6});
 			}
 
 	|	expr TOK_IN expr
 			{
 			set_location(@1, @3);
-			$$ = new zeek::detail::InExpr({AdoptRef{}, $1}, {AdoptRef{}, $3});
+			$$ = new zeek::detail::InExpr({zeek::AdoptRef{}, $1}, {zeek::AdoptRef{}, $3});
 			}
 
 	|	expr TOK_NOT_IN expr
 			{
 			set_location(@1, @3);
-			$$ = new zeek::detail::NotExpr(make_intrusive<zeek::detail::InExpr>(
-			        IntrusivePtr<zeek::detail::Expr>{AdoptRef{}, $1},
-			        IntrusivePtr<zeek::detail::Expr>{AdoptRef{}, $3}));
+			$$ = new zeek::detail::NotExpr(zeek::make_intrusive<zeek::detail::InExpr>(
+			        zeek::IntrusivePtr<zeek::detail::Expr>{zeek::AdoptRef{}, $1},
+			        zeek::IntrusivePtr<zeek::detail::Expr>{zeek::AdoptRef{}, $3}));
 			}
 
 	|	'[' expr_list ']'
@@ -540,7 +540,7 @@ expr:
 				}
 
 			if ( is_record_ctor )
-				$$ = new zeek::detail::RecordConstructorExpr({AdoptRef{}, $2});
+				$$ = new zeek::detail::RecordConstructorExpr({zeek::AdoptRef{}, $2});
 			else
 				$$ = $2;
 			}
@@ -548,35 +548,35 @@ expr:
 	|	'[' ']'
 			{
 			// We interpret this as an empty record constructor.
-			$$ = new zeek::detail::RecordConstructorExpr(make_intrusive<zeek::detail::ListExpr>());
+			$$ = new zeek::detail::RecordConstructorExpr(zeek::make_intrusive<zeek::detail::ListExpr>());
 			}
 
 
 	|	TOK_RECORD '(' expr_list ')'
 			{
 			set_location(@1, @4);
-			$$ = new zeek::detail::RecordConstructorExpr({AdoptRef{}, $3});
+			$$ = new zeek::detail::RecordConstructorExpr({zeek::AdoptRef{}, $3});
 			}
 
 	|	TOK_TABLE '(' { ++in_init; } opt_expr_list ')' { --in_init; }
 		opt_attr
 			{ // the ++in_init fixes up the parsing of "[x] = y"
 			set_location(@1, @5);
-			std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>> attrs{$7};
-			$$ = new zeek::detail::TableConstructorExpr({AdoptRef{}, $4}, std::move(attrs));
+			std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>> attrs{$7};
+			$$ = new zeek::detail::TableConstructorExpr({zeek::AdoptRef{}, $4}, std::move(attrs));
 			}
 
 	|	TOK_SET '(' opt_expr_list ')' opt_attr
 			{
 			set_location(@1, @4);
-			std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>> attrs{$5};
-			$$ = new zeek::detail::SetConstructorExpr({AdoptRef{}, $3}, std::move(attrs));
+			std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>> attrs{$5};
+			$$ = new zeek::detail::SetConstructorExpr({zeek::AdoptRef{}, $3}, std::move(attrs));
 			}
 
 	|	TOK_VECTOR '(' opt_expr_list ')'
 			{
 			set_location(@1, @4);
-			$$ = new zeek::detail::VectorConstructorExpr({AdoptRef{}, $3});
+			$$ = new zeek::detail::VectorConstructorExpr({zeek::AdoptRef{}, $3});
 			}
 
 	|	expr '('
@@ -602,23 +602,23 @@ expr:
 				switch ( ctor_type->Tag() ) {
 				case zeek::TYPE_RECORD:
 					{
-					auto rce = make_intrusive<zeek::detail::RecordConstructorExpr>(
-						IntrusivePtr<zeek::detail::ListExpr>{AdoptRef{}, $4});
-					auto rt = cast_intrusive<zeek::RecordType>(ctor_type);
+					auto rce = zeek::make_intrusive<zeek::detail::RecordConstructorExpr>(
+						zeek::IntrusivePtr<zeek::detail::ListExpr>{zeek::AdoptRef{}, $4});
+					auto rt = zeek::cast_intrusive<zeek::RecordType>(ctor_type);
 					$$ = new zeek::detail::RecordCoerceExpr(std::move(rce), std::move(rt));
 					}
 					break;
 
 				case zeek::TYPE_TABLE:
 					if ( ctor_type->IsTable() )
-						$$ = new zeek::detail::TableConstructorExpr({AdoptRef{}, $4}, 0, ctor_type);
+						$$ = new zeek::detail::TableConstructorExpr({zeek::AdoptRef{}, $4}, 0, ctor_type);
 					else
-						$$ = new zeek::detail::SetConstructorExpr({AdoptRef{}, $4}, 0, ctor_type);
+						$$ = new zeek::detail::SetConstructorExpr({zeek::AdoptRef{}, $4}, 0, ctor_type);
 
 					break;
 
 				case zeek::TYPE_VECTOR:
-					$$ = new zeek::detail::VectorConstructorExpr({AdoptRef{}, $4}, ctor_type);
+					$$ = new zeek::detail::VectorConstructorExpr({zeek::AdoptRef{}, $4}, ctor_type);
 					break;
 
 				default:
@@ -628,7 +628,7 @@ expr:
 				}
 
 			else
-				$$ = new zeek::detail::CallExpr({AdoptRef{}, $1}, {AdoptRef{}, $4}, in_hook > 0);
+				$$ = new zeek::detail::CallExpr({zeek::AdoptRef{}, $1}, {zeek::AdoptRef{}, $4}, in_hook > 0);
 			}
 
 	|	TOK_HOOK { ++in_hook; } expr
@@ -643,7 +643,7 @@ expr:
 	|	expr TOK_HAS_FIELD TOK_ID
 			{
 			set_location(@1, @3);
-			$$ = new zeek::detail::HasFieldExpr({AdoptRef{}, $1}, $3);
+			$$ = new zeek::detail::HasFieldExpr({zeek::AdoptRef{}, $1}, $3);
 			}
 
 	|	anonymous_function
@@ -652,7 +652,7 @@ expr:
 	|	TOK_SCHEDULE expr '{' event '}'
 			{
 			set_location(@1, @5);
-			$$ = new zeek::detail::ScheduleExpr({AdoptRef{}, $2}, {AdoptRef{}, $4});
+			$$ = new zeek::detail::ScheduleExpr({zeek::AdoptRef{}, $2}, {zeek::AdoptRef{}, $4});
 			}
 
 	|	TOK_ID
@@ -709,7 +709,7 @@ expr:
 	|	TOK_CONSTANT
 			{
 			set_location(@1);
-			$$ = new zeek::detail::ConstExpr({AdoptRef{}, $1});
+			$$ = new zeek::detail::ConstExpr({zeek::AdoptRef{}, $1});
 			}
 
 	|	'/' { begin_RE(); } TOK_PATTERN_TEXT TOK_PATTERN_END
@@ -723,16 +723,16 @@ expr:
 				re->MakeCaseInsensitive();
 
 			re->Compile();
-			$$ = new zeek::detail::ConstExpr(make_intrusive<PatternVal>(re));
+			$$ = new zeek::detail::ConstExpr(zeek::make_intrusive<PatternVal>(re));
 			}
 
 	|       '|' expr '|'	%prec '('
 			{
 			set_location(@1, @3);
-			IntrusivePtr<zeek::detail::Expr> e{AdoptRef{}, $2};
+			zeek::IntrusivePtr<zeek::detail::Expr> e{zeek::AdoptRef{}, $2};
 
 			if ( zeek::IsIntegral(e->GetType()->Tag()) )
-				e = make_intrusive<zeek::detail::ArithCoerceExpr>(std::move(e), zeek::TYPE_INT);
+				e = zeek::make_intrusive<zeek::detail::ArithCoerceExpr>(std::move(e), zeek::TYPE_INT);
 
 			$$ = new zeek::detail::SizeExpr(std::move(e));
 			}
@@ -740,13 +740,13 @@ expr:
 	|       expr TOK_AS type
 			{
 			set_location(@1, @3);
-			$$ = new zeek::detail::CastExpr({AdoptRef{}, $1}, {AdoptRef{}, $3});
+			$$ = new zeek::detail::CastExpr({zeek::AdoptRef{}, $1}, {zeek::AdoptRef{}, $3});
 			}
 
 	|       expr TOK_IS type
 			{
 			set_location(@1, @3);
-			$$ = new zeek::detail::IsExpr({AdoptRef{}, $1}, {AdoptRef{}, $3});
+			$$ = new zeek::detail::IsExpr({zeek::AdoptRef{}, $1}, {zeek::AdoptRef{}, $3});
 			}
 	;
 
@@ -754,13 +754,13 @@ expr_list:
 		expr_list ',' expr
 			{
 			set_location(@1, @3);
-			$1->Append({AdoptRef{}, $3});
+			$1->Append({zeek::AdoptRef{}, $3});
 			}
 
 	|	expr
 			{
 			set_location(@1);
-			$$ = new zeek::detail::ListExpr({AdoptRef{}, $1});
+			$$ = new zeek::detail::ListExpr({zeek::AdoptRef{}, $1});
 			}
 	;
 
@@ -899,13 +899,13 @@ type:
 	|	TOK_TABLE '[' type_list ']' TOK_OF type
 				{
 				set_location(@1, @6);
-				$$ = new zeek::TableType({AdoptRef{}, $3}, {AdoptRef{}, $6});
+				$$ = new zeek::TableType({zeek::AdoptRef{}, $3}, {zeek::AdoptRef{}, $6});
 				}
 
 	|	TOK_SET '[' type_list ']'
 				{
 				set_location(@1, @4);
-				$$ = new zeek::SetType({AdoptRef{}, $3}, nullptr);
+				$$ = new zeek::SetType({zeek::AdoptRef{}, $3}, nullptr);
 				}
 
 	|	TOK_RECORD '{'
@@ -951,7 +951,7 @@ type:
 	|	TOK_VECTOR TOK_OF type
 				{
 				set_location(@1, @3);
-				$$ = new zeek::VectorType({AdoptRef{}, $3});
+				$$ = new zeek::VectorType({zeek::AdoptRef{}, $3});
 				}
 
 	|	TOK_FUNCTION func_params
@@ -963,19 +963,19 @@ type:
 	|	TOK_EVENT '(' formal_args ')'
 				{
 				set_location(@1, @3);
-				$$ = new zeek::FuncType({AdoptRef{}, $3}, nullptr, zeek::FUNC_FLAVOR_EVENT);
+				$$ = new zeek::FuncType({zeek::AdoptRef{}, $3}, nullptr, zeek::FUNC_FLAVOR_EVENT);
 				}
 
 	|	TOK_HOOK '(' formal_args ')'
 				{
 				set_location(@1, @3);
-				$$ = new zeek::FuncType({AdoptRef{}, $3}, zeek::base_type(zeek::TYPE_BOOL), zeek::FUNC_FLAVOR_HOOK);
+				$$ = new zeek::FuncType({zeek::AdoptRef{}, $3}, zeek::base_type(zeek::TYPE_BOOL), zeek::FUNC_FLAVOR_HOOK);
 				}
 
 	|	TOK_FILE TOK_OF type
 				{
 				set_location(@1, @3);
-				$$ = new zeek::FileType({AdoptRef{}, $3});
+				$$ = new zeek::FileType({zeek::AdoptRef{}, $3});
 				}
 
 	|	TOK_FILE
@@ -1011,11 +1011,11 @@ type:
 
 type_list:
 		type_list ',' type
-			{ $1->AppendEvenIfNotPure({AdoptRef{}, $3}); }
+			{ $1->AppendEvenIfNotPure({zeek::AdoptRef{}, $3}); }
 	|	type
 			{
-			$$ = new zeek::TypeList({NewRef{}, $1});
-			$$->Append({AdoptRef{}, $1});
+			$$ = new zeek::TypeList({zeek::NewRef{}, $1});
+			$$->Append({zeek::AdoptRef{}, $1});
 			}
 	;
 
@@ -1034,8 +1034,8 @@ type_decl:
 		TOK_ID ':' type opt_attr ';'
 			{
 			set_location(@1, @4);
-			auto attrs = make_attributes($4, {NewRef{}, $3}, in_record > 0, false);
-			$$ = new zeek::TypeDecl($1, {AdoptRef{}, $3}, std::move(attrs));
+			auto attrs = make_attributes($4, {zeek::NewRef{}, $3}, in_record > 0, false);
+			$$ = new zeek::TypeDecl($1, {zeek::AdoptRef{}, $3}, std::move(attrs));
 
 			if ( in_record > 0 && cur_decl_type_id )
 				zeekygen_mgr->RecordField(cur_decl_type_id, $$, ::filename);
@@ -1064,8 +1064,8 @@ formal_args_decl:
 		TOK_ID ':' type opt_attr
 			{
 			set_location(@1, @4);
-			auto attrs = make_attributes($4, {NewRef{}, $3}, true, false);
-			$$ = new zeek::TypeDecl($1, {AdoptRef{}, $3}, std::move(attrs));
+			auto attrs = make_attributes($4, {zeek::NewRef{}, $3}, true, false);
+			$$ = new zeek::TypeDecl($1, {zeek::AdoptRef{}, $3}, std::move(attrs));
 			}
 	;
 
@@ -1081,37 +1081,37 @@ decl:
 
 	|	TOK_GLOBAL def_global_id opt_type init_class opt_init opt_attr ';'
 			{
-			IntrusivePtr id{AdoptRef{}, $2};
-			add_global(id, {AdoptRef{}, $3}, $4, {AdoptRef{}, $5},
-			           std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>>{$6},
+			zeek::IntrusivePtr id{zeek::AdoptRef{}, $2};
+			add_global(id, {zeek::AdoptRef{}, $3}, $4, {zeek::AdoptRef{}, $5},
+			           std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>>{$6},
 			           VAR_REGULAR);
 			zeekygen_mgr->Identifier(std::move(id));
 			}
 
 	|	TOK_OPTION def_global_id opt_type init_class opt_init opt_attr ';'
 			{
-			IntrusivePtr id{AdoptRef{}, $2};
-			add_global(id, {AdoptRef{}, $3}, $4, {AdoptRef{}, $5},
-			           std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>>{$6},
+			zeek::IntrusivePtr id{zeek::AdoptRef{}, $2};
+			add_global(id, {zeek::AdoptRef{}, $3}, $4, {zeek::AdoptRef{}, $5},
+			           std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>>{$6},
 			           VAR_OPTION);
 			zeekygen_mgr->Identifier(std::move(id));
 			}
 
 	|	TOK_CONST def_global_id opt_type init_class opt_init opt_attr ';'
 			{
-			IntrusivePtr id{AdoptRef{}, $2};
-			add_global(id, {AdoptRef{}, $3}, $4, {AdoptRef{}, $5},
-			           std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>>{$6},
+			zeek::IntrusivePtr id{zeek::AdoptRef{}, $2};
+			add_global(id, {zeek::AdoptRef{}, $3}, $4, {zeek::AdoptRef{}, $5},
+			           std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>>{$6},
 			           VAR_CONST);
 			zeekygen_mgr->Identifier(std::move(id));
 			}
 
 	|	TOK_REDEF global_id opt_type init_class opt_init opt_attr ';'
 			{
-			IntrusivePtr id{AdoptRef{}, $2};
-			IntrusivePtr<zeek::detail::Expr> init{AdoptRef{}, $5};
-			add_global(id, {AdoptRef{}, $3}, $4, init,
-			           std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>>{$6},
+			zeek::IntrusivePtr id{zeek::AdoptRef{}, $2};
+			zeek::IntrusivePtr<zeek::detail::Expr> init{zeek::AdoptRef{}, $5};
+			add_global(id, {zeek::AdoptRef{}, $3}, $4, init,
+			           std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>>{$6},
 			           VAR_REDEF);
 			zeekygen_mgr->Redef(id.get(), ::filename, $4, std::move(init));
 			}
@@ -1137,17 +1137,17 @@ decl:
 				$3->Error("unknown identifier");
 			else
 				extend_record($3, std::unique_ptr<zeek::type_decl_list>($8),
-				              std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>>($11));
+				              std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>>($11));
 			}
 
 	|	TOK_TYPE global_id ':'
-			{ cur_decl_type_id = $2; zeekygen_mgr->StartType({NewRef{}, $2});  }
+			{ cur_decl_type_id = $2; zeekygen_mgr->StartType({zeek::NewRef{}, $2});  }
 		type opt_attr ';'
 			{
 			cur_decl_type_id = 0;
-			IntrusivePtr id{AdoptRef{}, $2};
-			add_type(id.get(), {AdoptRef{}, $5},
-			         std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>>{$6});
+			zeek::IntrusivePtr id{zeek::AdoptRef{}, $2};
+			add_type(id.get(), {zeek::AdoptRef{}, $5},
+			         std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>>{$6});
 			zeekygen_mgr->Identifier(std::move(id));
 			}
 
@@ -1178,10 +1178,10 @@ conditional:
 func_hdr:
 		TOK_FUNCTION def_global_id func_params opt_attr
 			{
-			IntrusivePtr id{AdoptRef{}, $2};
+			zeek::IntrusivePtr id{zeek::AdoptRef{}, $2};
 			begin_func(id, current_module.c_str(),
-				zeek::FUNC_FLAVOR_FUNCTION, 0, {NewRef{}, $3},
-				std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>>{$4});
+				zeek::FUNC_FLAVOR_FUNCTION, 0, {zeek::NewRef{}, $3},
+				std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>>{$4});
 			$$ = $3;
 			zeekygen_mgr->Identifier(std::move(id));
 			}
@@ -1194,25 +1194,25 @@ func_hdr:
 				reporter->Error("event %s() is no longer available, use zeek_%s() instead", name, base.c_str());
 				}
 
-			begin_func({NewRef{}, $2}, current_module.c_str(),
-				   zeek::FUNC_FLAVOR_EVENT, 0, {NewRef{}, $3},
-				   std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>>{$4});
+			begin_func({zeek::NewRef{}, $2}, current_module.c_str(),
+				   zeek::FUNC_FLAVOR_EVENT, 0, {zeek::NewRef{}, $3},
+				   std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>>{$4});
 			$$ = $3;
 			}
 	|	TOK_HOOK def_global_id func_params opt_attr
 			{
 			$3->ClearYieldType(zeek::FUNC_FLAVOR_HOOK);
 			$3->SetYieldType(zeek::base_type(zeek::TYPE_BOOL));
-			begin_func({NewRef{}, $2}, current_module.c_str(),
-				   zeek::FUNC_FLAVOR_HOOK, 0, {NewRef{}, $3},
-				   std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>>{$4});
+			begin_func({zeek::NewRef{}, $2}, current_module.c_str(),
+				   zeek::FUNC_FLAVOR_HOOK, 0, {zeek::NewRef{}, $3},
+				   std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>>{$4});
 			$$ = $3;
 			}
 	|	TOK_REDEF TOK_EVENT event_id func_params opt_attr
 			{
-			begin_func({NewRef{}, $3}, current_module.c_str(),
-				   zeek::FUNC_FLAVOR_EVENT, 1, {NewRef{}, $4},
-				   std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>>{$5});
+			begin_func({zeek::NewRef{}, $3}, current_module.c_str(),
+				   zeek::FUNC_FLAVOR_EVENT, 1, {zeek::NewRef{}, $4},
+				   std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>>{$5});
 			$$ = $4;
 			}
 	;
@@ -1233,7 +1233,7 @@ func_body:
 		'}'
 			{
 			set_location(func_hdr_location, @5);
-			end_func({AdoptRef{}, $3});
+			end_func({zeek::AdoptRef{}, $3});
 			}
 	;
 
@@ -1259,7 +1259,7 @@ lambda_body:
 			// a lambda expression.
 
 			// Gather the ingredients for a BroFunc from the current scope
-			auto ingredients = std::make_unique<function_ingredients>(IntrusivePtr{NewRef{}, current_scope()}, IntrusivePtr{AdoptRef{}, $3});
+			auto ingredients = std::make_unique<function_ingredients>(zeek::IntrusivePtr{zeek::NewRef{}, current_scope()}, zeek::IntrusivePtr{zeek::AdoptRef{}, $3});
 			id_list outer_ids = gather_outer_ids(pop_scope().get(), ingredients->body.get());
 
 			$$ = new zeek::detail::LambdaExpr(std::move(ingredients), std::move(outer_ids));
@@ -1275,16 +1275,16 @@ begin_func:
 		func_params
 			{
 			auto id = current_scope()->GenerateTemporary("anonymous-function");
-			begin_func(id, current_module.c_str(), zeek::FUNC_FLAVOR_FUNCTION, 0, {AdoptRef{}, $1});
+			begin_func(id, current_module.c_str(), zeek::FUNC_FLAVOR_FUNCTION, 0, {zeek::AdoptRef{}, $1});
 			$$ = id.release();
 			}
 	;
 
 func_params:
 		'(' formal_args ')' ':' type
-			{ $$ = new zeek::FuncType({AdoptRef{}, $2}, {AdoptRef{}, $5}, zeek::FUNC_FLAVOR_FUNCTION); }
+			{ $$ = new zeek::FuncType({zeek::AdoptRef{}, $2}, {zeek::AdoptRef{}, $5}, zeek::FUNC_FLAVOR_FUNCTION); }
 	|	'(' formal_args ')'
-			{ $$ = new zeek::FuncType({AdoptRef{}, $2}, zeek::base_type(zeek::TYPE_VOID), zeek::FUNC_FLAVOR_FUNCTION); }
+			{ $$ = new zeek::FuncType({zeek::AdoptRef{}, $2}, zeek::base_type(zeek::TYPE_VOID), zeek::FUNC_FLAVOR_FUNCTION); }
 	;
 
 opt_type:
@@ -1321,19 +1321,19 @@ index_slice:
 			{
 			set_location(@1, @6);
 
-			auto low = $3 ? IntrusivePtr<zeek::detail::Expr>{AdoptRef{}, $3} :
-			                make_intrusive<zeek::detail::ConstExpr>(val_mgr->Count(0));
+			auto low = $3 ? zeek::IntrusivePtr<zeek::detail::Expr>{zeek::AdoptRef{}, $3} :
+			                zeek::make_intrusive<zeek::detail::ConstExpr>(val_mgr->Count(0));
 
-			auto high = $5 ? IntrusivePtr<zeek::detail::Expr>{AdoptRef{}, $5} :
-			                 make_intrusive<zeek::detail::SizeExpr>(
-			                     IntrusivePtr<zeek::detail::Expr>{NewRef{}, $1});
+			auto high = $5 ? zeek::IntrusivePtr<zeek::detail::Expr>{zeek::AdoptRef{}, $5} :
+			                 zeek::make_intrusive<zeek::detail::SizeExpr>(
+			                     zeek::IntrusivePtr<zeek::detail::Expr>{zeek::NewRef{}, $1});
 
 			if ( ! zeek::IsIntegral(low->GetType()->Tag()) || ! zeek::IsIntegral(high->GetType()->Tag()) )
 				reporter->Error("slice notation must have integral values as indexes");
 
-			auto le = make_intrusive<zeek::detail::ListExpr>(std::move(low));
+			auto le = zeek::make_intrusive<zeek::detail::ListExpr>(std::move(low));
 			le->Append(std::move(high));
-			$$ = new zeek::detail::IndexExpr({AdoptRef{}, $1}, std::move(le), true);
+			$$ = new zeek::detail::IndexExpr({zeek::AdoptRef{}, $1}, std::move(le), true);
 			}
 
 opt_attr:
@@ -1344,41 +1344,41 @@ opt_attr:
 
 attr_list:
 		attr_list attr
-			{ $1->emplace_back(AdoptRef{}, $2); }
+			{ $1->emplace_back(zeek::AdoptRef{}, $2); }
 	|	attr
 			{
-			$$ = new std::vector<IntrusivePtr<zeek::detail::Attr>>;
-			$$->emplace_back(AdoptRef{}, $1);
+			$$ = new std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>;
+			$$->emplace_back(zeek::AdoptRef{}, $1);
 			}
 	;
 
 attr:
 		TOK_ATTR_DEFAULT '=' expr
-		        { $$ = new zeek::detail::Attr(zeek::detail::ATTR_DEFAULT, {AdoptRef{}, $3}); }
+		        { $$ = new zeek::detail::Attr(zeek::detail::ATTR_DEFAULT, {zeek::AdoptRef{}, $3}); }
 	|	TOK_ATTR_OPTIONAL
 			{ $$ = new zeek::detail::Attr(zeek::detail::ATTR_OPTIONAL); }
 	|	TOK_ATTR_REDEF
 			{ $$ = new zeek::detail::Attr(zeek::detail::ATTR_REDEF); }
 	|	TOK_ATTR_ADD_FUNC '=' expr
-			{ $$ = new zeek::detail::Attr(zeek::detail::ATTR_ADD_FUNC, {AdoptRef{}, $3}); }
+			{ $$ = new zeek::detail::Attr(zeek::detail::ATTR_ADD_FUNC, {zeek::AdoptRef{}, $3}); }
 	|	TOK_ATTR_DEL_FUNC '=' expr
-			{ $$ = new zeek::detail::Attr(zeek::detail::ATTR_DEL_FUNC, {AdoptRef{}, $3}); }
+			{ $$ = new zeek::detail::Attr(zeek::detail::ATTR_DEL_FUNC, {zeek::AdoptRef{}, $3}); }
 	|	TOK_ATTR_ON_CHANGE '=' expr
-			{ $$ = new zeek::detail::Attr(zeek::detail::ATTR_ON_CHANGE, {AdoptRef{}, $3}); }
+			{ $$ = new zeek::detail::Attr(zeek::detail::ATTR_ON_CHANGE, {zeek::AdoptRef{}, $3}); }
 	|	TOK_ATTR_EXPIRE_FUNC '=' expr
-			{ $$ = new zeek::detail::Attr(zeek::detail::ATTR_EXPIRE_FUNC, {AdoptRef{}, $3}); }
+			{ $$ = new zeek::detail::Attr(zeek::detail::ATTR_EXPIRE_FUNC, {zeek::AdoptRef{}, $3}); }
 	|	TOK_ATTR_EXPIRE_CREATE '=' expr
-			{ $$ = new zeek::detail::Attr(zeek::detail::ATTR_EXPIRE_CREATE, {AdoptRef{}, $3}); }
+			{ $$ = new zeek::detail::Attr(zeek::detail::ATTR_EXPIRE_CREATE, {zeek::AdoptRef{}, $3}); }
 	|	TOK_ATTR_EXPIRE_READ '=' expr
-			{ $$ = new zeek::detail::Attr(zeek::detail::ATTR_EXPIRE_READ, {AdoptRef{}, $3}); }
+			{ $$ = new zeek::detail::Attr(zeek::detail::ATTR_EXPIRE_READ, {zeek::AdoptRef{}, $3}); }
 	|	TOK_ATTR_EXPIRE_WRITE '=' expr
-			{ $$ = new zeek::detail::Attr(zeek::detail::ATTR_EXPIRE_WRITE, {AdoptRef{}, $3}); }
+			{ $$ = new zeek::detail::Attr(zeek::detail::ATTR_EXPIRE_WRITE, {zeek::AdoptRef{}, $3}); }
 	|	TOK_ATTR_RAW_OUTPUT
 			{ $$ = new zeek::detail::Attr(zeek::detail::ATTR_RAW_OUTPUT); }
 	|	TOK_ATTR_PRIORITY '=' expr
-			{ $$ = new zeek::detail::Attr(zeek::detail::ATTR_PRIORITY, {AdoptRef{}, $3}); }
+			{ $$ = new zeek::detail::Attr(zeek::detail::ATTR_PRIORITY, {zeek::AdoptRef{}, $3}); }
 	|	TOK_ATTR_TYPE_COLUMN '=' expr
-			{ $$ = new zeek::detail::Attr(zeek::detail::ATTR_TYPE_COLUMN, {AdoptRef{}, $3}); }
+			{ $$ = new zeek::detail::Attr(zeek::detail::ATTR_TYPE_COLUMN, {zeek::AdoptRef{}, $3}); }
 	|	TOK_ATTR_LOG
 			{ $$ = new zeek::detail::Attr(zeek::detail::ATTR_LOG); }
 	|	TOK_ATTR_ERROR_HANDLER
@@ -1390,7 +1390,7 @@ attr:
 			if ( zeek::IsString($3->GetType()->Tag()) )
 				$$ = new zeek::detail::Attr(
 					zeek::detail::ATTR_DEPRECATED,
-					make_intrusive<zeek::detail::ConstExpr>(IntrusivePtr{AdoptRef{}, $3}));
+					zeek::make_intrusive<zeek::detail::ConstExpr>(zeek::IntrusivePtr{zeek::AdoptRef{}, $3}));
 			else
 				{
 				ODesc d;
@@ -1415,7 +1415,7 @@ stmt:
 	|	TOK_PRINT expr_list ';' opt_no_test
 			{
 			set_location(@1, @3);
-			$$ = new zeek::detail::PrintStmt(IntrusivePtr{AdoptRef{}, $2});
+			$$ = new zeek::detail::PrintStmt(zeek::IntrusivePtr{zeek::AdoptRef{}, $2});
 			if ( ! $4 )
 			    brofiler.AddStmt($$);
 			}
@@ -1423,7 +1423,7 @@ stmt:
 	|	TOK_EVENT event ';' opt_no_test
 			{
 			set_location(@1, @3);
-			$$ = new zeek::detail::EventStmt({AdoptRef{}, $2});
+			$$ = new zeek::detail::EventStmt({zeek::AdoptRef{}, $2});
 			if ( ! $4 )
 			    brofiler.AddStmt($$);
 			}
@@ -1431,29 +1431,29 @@ stmt:
 	|	TOK_IF '(' expr ')' stmt
 			{
 			set_location(@1, @4);
-			$$ = new zeek::detail::IfStmt({AdoptRef{}, $3}, {AdoptRef{}, $5}, make_intrusive<zeek::detail::NullStmt>());
+			$$ = new zeek::detail::IfStmt({zeek::AdoptRef{}, $3}, {zeek::AdoptRef{}, $5}, zeek::make_intrusive<zeek::detail::NullStmt>());
 			}
 
 	|	TOK_IF '(' expr ')' stmt TOK_ELSE stmt
 			{
 			set_location(@1, @4);
-			$$ = new zeek::detail::IfStmt({AdoptRef{}, $3}, {AdoptRef{}, $5}, {AdoptRef{}, $7});
+			$$ = new zeek::detail::IfStmt({zeek::AdoptRef{}, $3}, {zeek::AdoptRef{}, $5}, {zeek::AdoptRef{}, $7});
 			}
 
 	|	TOK_SWITCH expr '{' case_list '}'
 			{
 			set_location(@1, @2);
-			$$ = new zeek::detail::SwitchStmt({AdoptRef{}, $2}, $4);
+			$$ = new zeek::detail::SwitchStmt({zeek::AdoptRef{}, $2}, $4);
 			}
 
 	|	for_head stmt
 			{
-			$1->AsForStmt()->AddBody({AdoptRef{}, $2});
+			$1->AsForStmt()->AddBody({zeek::AdoptRef{}, $2});
 			}
 
 	|	TOK_WHILE '(' expr ')' stmt
 			{
-			$$ = new zeek::detail::WhileStmt({AdoptRef{}, $3}, {AdoptRef{}, $5});
+			$$ = new zeek::detail::WhileStmt({zeek::AdoptRef{}, $3}, {zeek::AdoptRef{}, $5});
 			}
 
 	|	TOK_NEXT ';' opt_no_test
@@ -1491,7 +1491,7 @@ stmt:
 	|	TOK_RETURN expr ';' opt_no_test
 			{
 			set_location(@1, @2);
-			$$ = new zeek::detail::ReturnStmt({AdoptRef{}, $2});
+			$$ = new zeek::detail::ReturnStmt({zeek::AdoptRef{}, $2});
 			if ( ! $4 )
 			    brofiler.AddStmt($$);
 			}
@@ -1499,7 +1499,7 @@ stmt:
 	|	TOK_ADD expr ';' opt_no_test
 			{
 			set_location(@1, @3);
-			$$ = new zeek::detail::AddStmt({AdoptRef{}, $2});
+			$$ = new zeek::detail::AddStmt({zeek::AdoptRef{}, $2});
 			if ( ! $4 )
 			    brofiler.AddStmt($$);
 			}
@@ -1507,7 +1507,7 @@ stmt:
 	|	TOK_DELETE expr ';' opt_no_test
 			{
 			set_location(@1, @3);
-			$$ = new zeek::detail::DelStmt({AdoptRef{}, $2});
+			$$ = new zeek::detail::DelStmt({zeek::AdoptRef{}, $2});
 			if ( ! $4 )
 			    brofiler.AddStmt($$);
 			}
@@ -1515,9 +1515,9 @@ stmt:
 	|	TOK_LOCAL local_id opt_type init_class opt_init opt_attr ';' opt_no_test
 			{
 			set_location(@1, @7);
-			$$ = add_local({AdoptRef{}, $2}, {AdoptRef{}, $3}, $4,
-			               {AdoptRef{}, $5},
-			               std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>>{$6},
+			$$ = add_local({zeek::AdoptRef{}, $2}, {zeek::AdoptRef{}, $3}, $4,
+			               {zeek::AdoptRef{}, $5},
+			               std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>>{$6},
 			               VAR_REGULAR).release();
 			if ( ! $8 )
 			    brofiler.AddStmt($$);
@@ -1526,9 +1526,9 @@ stmt:
 	|	TOK_CONST local_id opt_type init_class opt_init opt_attr ';' opt_no_test
 			{
 			set_location(@1, @6);
-			$$ = add_local({AdoptRef{}, $2}, {AdoptRef{}, $3}, $4,
-			               {AdoptRef{}, $5},
-			               std::unique_ptr<std::vector<IntrusivePtr<zeek::detail::Attr>>>{$6},
+			$$ = add_local({zeek::AdoptRef{}, $2}, {zeek::AdoptRef{}, $3}, $4,
+			               {zeek::AdoptRef{}, $5},
+			               std::unique_ptr<std::vector<zeek::IntrusivePtr<zeek::detail::Attr>>>{$6},
 			               VAR_CONST).release();
 			if ( ! $8 )
 			    brofiler.AddStmt($$);
@@ -1537,15 +1537,15 @@ stmt:
 	|	TOK_WHEN '(' expr ')' stmt
 			{
 			set_location(@3, @5);
-			$$ = new zeek::detail::WhenStmt({AdoptRef{}, $3}, {AdoptRef{}, $5},
+			$$ = new zeek::detail::WhenStmt({zeek::AdoptRef{}, $3}, {zeek::AdoptRef{}, $5},
 			                                  nullptr, nullptr, false);
 			}
 
 	|	TOK_WHEN '(' expr ')' stmt TOK_TIMEOUT expr '{' opt_no_test_block stmt_list '}'
 			{
 			set_location(@3, @9);
-			$$ = new zeek::detail::WhenStmt({AdoptRef{}, $3}, {AdoptRef{}, $5},
-			                                  {AdoptRef{}, $10}, {AdoptRef{}, $7}, false);
+			$$ = new zeek::detail::WhenStmt({zeek::AdoptRef{}, $3}, {zeek::AdoptRef{}, $5},
+			                                  {zeek::AdoptRef{}, $10}, {zeek::AdoptRef{}, $7}, false);
 			if ( $9 )
 			    brofiler.DecIgnoreDepth();
 			}
@@ -1554,15 +1554,15 @@ stmt:
 	|	TOK_RETURN TOK_WHEN '(' expr ')' stmt
 			{
 			set_location(@4, @6);
-			$$ = new zeek::detail::WhenStmt({AdoptRef{}, $4}, {AdoptRef{}, $6}, nullptr,
+			$$ = new zeek::detail::WhenStmt({zeek::AdoptRef{}, $4}, {zeek::AdoptRef{}, $6}, nullptr,
 			                  nullptr, true);
 			}
 
 	|	TOK_RETURN TOK_WHEN '(' expr ')' stmt TOK_TIMEOUT expr '{' opt_no_test_block stmt_list '}'
 			{
 			set_location(@4, @10);
-			$$ = new zeek::detail::WhenStmt({AdoptRef{}, $4}, {AdoptRef{}, $6},
-			                                  {AdoptRef{}, $11}, {AdoptRef{}, $8}, true);
+			$$ = new zeek::detail::WhenStmt({zeek::AdoptRef{}, $4}, {zeek::AdoptRef{}, $6},
+			                                  {zeek::AdoptRef{}, $11}, {zeek::AdoptRef{}, $8}, true);
 			if ( $10 )
 			    brofiler.DecIgnoreDepth();
 			}
@@ -1570,8 +1570,8 @@ stmt:
 	|	index_slice '=' expr ';' opt_no_test
 			{
 			set_location(@1, @4);
-			$$ = new zeek::detail::ExprStmt(zeek::detail::get_assign_expr({AdoptRef{}, $1},
-			                                  {AdoptRef{}, $3}, in_init));
+			$$ = new zeek::detail::ExprStmt(zeek::detail::get_assign_expr({zeek::AdoptRef{}, $1},
+			                                  {zeek::AdoptRef{}, $3}, in_init));
 
 			if ( ! $5 )
 				brofiler.AddStmt($$);
@@ -1580,7 +1580,7 @@ stmt:
 	|	expr ';' opt_no_test
 			{
 			set_location(@1, @2);
-			$$ = new zeek::detail::ExprStmt({AdoptRef{}, $1});
+			$$ = new zeek::detail::ExprStmt({zeek::AdoptRef{}, $1});
 			if ( ! $3 )
 			    brofiler.AddStmt($$);
 			}
@@ -1624,7 +1624,7 @@ event:
 					reporter->Warning("%s", id->GetDeprecationWarning().c_str());
 				}
 
-			$$ = new zeek::detail::EventExpr($1, {AdoptRef{}, $3});
+			$$ = new zeek::detail::EventExpr($1, {zeek::AdoptRef{}, $3});
 			}
 	;
 
@@ -1637,13 +1637,13 @@ case_list:
 
 case:
 		TOK_CASE expr_list ':' stmt_list
-			{ $$ = new zeek::detail::Case({AdoptRef{}, $2}, 0, {AdoptRef{}, $4}); }
+			{ $$ = new zeek::detail::Case({zeek::AdoptRef{}, $2}, 0, {zeek::AdoptRef{}, $4}); }
 	|
 		TOK_CASE case_type_list ':' stmt_list
-			{ $$ = new zeek::detail::Case(nullptr, $2, {AdoptRef{}, $4}); }
+			{ $$ = new zeek::detail::Case(nullptr, $2, {zeek::AdoptRef{}, $4}); }
 	|
 		TOK_DEFAULT ':' stmt_list
-			{ $$ = new zeek::detail::Case(nullptr, 0, {AdoptRef{}, $3}); }
+			{ $$ = new zeek::detail::Case(nullptr, 0, {zeek::AdoptRef{}, $3}); }
 	;
 
 case_type_list:
@@ -1661,13 +1661,13 @@ case_type:
 		TOK_TYPE type
 			{
 			$$ = new zeek::detail::ID(0, zeek::detail::SCOPE_FUNCTION, 0);
-			$$->SetType({AdoptRef{}, $2});
+			$$->SetType({zeek::AdoptRef{}, $2});
 			}
 
 	|	TOK_TYPE type TOK_AS TOK_ID
 			{
 			const char* name = $4;
-			IntrusivePtr<zeek::Type> type{AdoptRef{}, $2};
+			zeek::IntrusivePtr<zeek::Type> type{zeek::AdoptRef{}, $2};
 			auto case_var = lookup_ID(name, current_module.c_str());
 
 			if ( case_var && case_var->IsGlobal() )
@@ -1706,12 +1706,12 @@ for_head:
 			id_list* loop_vars = new id_list;
 			loop_vars->push_back(loop_var.release());
 
-			$$ = new zeek::detail::ForStmt(loop_vars, {AdoptRef{}, $5});
+			$$ = new zeek::detail::ForStmt(loop_vars, {zeek::AdoptRef{}, $5});
 			}
 	|
 		TOK_FOR '(' '[' local_id_list ']' TOK_IN expr ')'
 			{
-			$$ = new zeek::detail::ForStmt($4, {AdoptRef{}, $7});
+			$$ = new zeek::detail::ForStmt($4, {zeek::AdoptRef{}, $7});
 			}
 	|
 		TOK_FOR '(' TOK_ID ',' TOK_ID TOK_IN expr ')'
@@ -1744,7 +1744,7 @@ for_head:
 			id_list* loop_vars = new id_list;
 			loop_vars->push_back(key_var.release());
 
-			$$ = new zeek::detail::ForStmt(loop_vars, {AdoptRef{}, $7}, std::move(val_var));
+			$$ = new zeek::detail::ForStmt(loop_vars, {zeek::AdoptRef{}, $7}, std::move(val_var));
 			}
 	|
 		TOK_FOR '(' '[' local_id_list ']' ',' TOK_ID TOK_IN expr ')'
@@ -1763,7 +1763,7 @@ for_head:
 			else
 				val_var = install_ID($7, module, false, false);
 
-			$$ = new zeek::detail::ForStmt($4, {AdoptRef{}, $9}, std::move(val_var));
+			$$ = new zeek::detail::ForStmt($4, {zeek::AdoptRef{}, $9}, std::move(val_var));
 			}
 	;
 
@@ -1880,19 +1880,19 @@ opt_no_test_block:
 
 opt_deprecated:
 		TOK_ATTR_DEPRECATED
-			{ $$ = new zeek::detail::ConstExpr(make_intrusive<StringVal>("")); }
+			{ $$ = new zeek::detail::ConstExpr(zeek::make_intrusive<StringVal>("")); }
 	|
 		TOK_ATTR_DEPRECATED '=' TOK_CONSTANT
 			{
 			if ( zeek::IsString($3->GetType()->Tag()) )
-				$$ = new zeek::detail::ConstExpr({AdoptRef{}, $3});
+				$$ = new zeek::detail::ConstExpr({zeek::AdoptRef{}, $3});
 			else
 				{
 				ODesc d;
 				$3->Describe(&d);
 				reporter->Error("'&deprecated=%s' must use a string literal",
 				                d.Description());
-				$$ = new zeek::detail::ConstExpr(make_intrusive<StringVal>(""));
+				$$ = new zeek::detail::ConstExpr(zeek::make_intrusive<StringVal>(""));
 				}
 			}
 	|
diff --git a/src/plugin/ComponentManager.h b/src/plugin/ComponentManager.h
index f503066a51..45e9ae0ebb 100644
--- a/src/plugin/ComponentManager.h
+++ b/src/plugin/ComponentManager.h
@@ -52,7 +52,7 @@ public:
 	/**
 	 * @return The enum type associated with the script-layer "Tag".
 	 */
-	const IntrusivePtr<zeek::EnumType>& GetTagType() const;
+	const zeek::IntrusivePtr<zeek::EnumType>& GetTagType() const;
 
 	[[deprecated("Remove in v4.1.  Use GetTagType() instead.")]]
 	zeek::EnumType* GetTagEnumType() const;
@@ -71,7 +71,7 @@ public:
 	 * @param val A component's enum value.
 	 * @return The canonical component name.
 	 */
-	const std::string& GetComponentName(IntrusivePtr<EnumVal> val) const;
+	const std::string& GetComponentName(zeek::IntrusivePtr<EnumVal> val) const;
 
 	[[deprecated("Remove in v4.1.  Use IntrusivePtr argument instead.")]]
 	const std::string& GetComponentName(Val* val) const;
@@ -128,7 +128,7 @@ public:
 
 private:
 	std::string module; /**< Script layer module in which component tags live. */
-	IntrusivePtr<zeek::EnumType> tag_enum_type; /**< Enum type of component tags. */
+	zeek::IntrusivePtr<zeek::EnumType> tag_enum_type; /**< Enum type of component tags. */
 	std::map<std::string, C*> components_by_name;
 	std::map<T, C*> components_by_tag;
 	std::map<int, C*> components_by_val;
@@ -137,7 +137,7 @@ private:
 template <class T, class C>
 ComponentManager<T, C>::ComponentManager(const std::string& arg_module, const std::string& local_id)
 	: module(arg_module),
-	  tag_enum_type(make_intrusive<zeek::EnumType>(module + "::" + local_id))
+	  tag_enum_type(zeek::make_intrusive<zeek::EnumType>(module + "::" + local_id))
 	{
 	auto id = install_ID(local_id.c_str(), module.c_str(), true, true);
 	add_type(id.get(), tag_enum_type, nullptr);
@@ -163,7 +163,7 @@ std::list<C*> ComponentManager<T, C>::GetComponents() const
 	}
 
 template <class T, class C>
-const IntrusivePtr<zeek::EnumType>& ComponentManager<T, C>::GetTagType() const
+const zeek::IntrusivePtr<zeek::EnumType>& ComponentManager<T, C>::GetTagType() const
 	{
 	return tag_enum_type;
 	}
@@ -193,7 +193,7 @@ const std::string& ComponentManager<T, C>::GetComponentName(T tag) const
 	}
 
 template <class T, class C>
-const std::string& ComponentManager<T, C>::GetComponentName(IntrusivePtr<EnumVal> val) const
+const std::string& ComponentManager<T, C>::GetComponentName(zeek::IntrusivePtr<EnumVal> val) const
 	{
 	return GetComponentName(T(std::move(val)));
 	}
@@ -201,7 +201,7 @@ const std::string& ComponentManager<T, C>::GetComponentName(IntrusivePtr<EnumVal
 template <class T, class C>
 const std::string& ComponentManager<T, C>::GetComponentName(Val* val) const
 	{
-	return GetComponentName(T({NewRef{}, val->AsEnumVal()}));
+	return GetComponentName(T({zeek::NewRef{}, val->AsEnumVal()}));
 	}
 
 template <class T, class C>
diff --git a/src/plugin/Manager.cc b/src/plugin/Manager.cc
index 2c2abcd168..f4feb6e964 100644
--- a/src/plugin/Manager.cc
+++ b/src/plugin/Manager.cc
@@ -616,7 +616,7 @@ int Manager::HookLoadFile(const Plugin::LoadType type, const string& file, const
 	return rc;
 	}
 
-std::pair<bool, IntrusivePtr<Val>>
+std::pair<bool, zeek::IntrusivePtr<Val>>
 Manager::HookCallFunction(const Func* func, Frame* parent,
                           zeek::Args* vecargs) const
 	{
@@ -638,7 +638,7 @@ Manager::HookCallFunction(const Func* func, Frame* parent,
 
 	hook_list* l = hooks[zeek::plugin::HOOK_CALL_FUNCTION];
 
-	std::pair<bool, IntrusivePtr<Val>> rval{false, nullptr};
+	std::pair<bool, zeek::IntrusivePtr<Val>> rval{false, nullptr};
 
 	if ( l )
 		{
diff --git a/src/plugin/Manager.h b/src/plugin/Manager.h
index 1831aa6710..a52a4d54be 100644
--- a/src/plugin/Manager.h
+++ b/src/plugin/Manager.h
@@ -255,7 +255,7 @@ public:
 	 * it may be any Val and must be ignored). If no plugin handled the call,
 	 * the method returns null.
 	 */
-	std::pair<bool, IntrusivePtr<Val>>
+	std::pair<bool, zeek::IntrusivePtr<Val>>
 	HookCallFunction(const Func* func, Frame* parent, zeek::Args* args) const;
 
 	/**
diff --git a/src/plugin/Plugin.cc b/src/plugin/Plugin.cc
index 38da5d3767..3bc07413e9 100644
--- a/src/plugin/Plugin.cc
+++ b/src/plugin/Plugin.cc
@@ -375,7 +375,7 @@ int Plugin::HookLoadFile(const LoadType type, const std::string& file, const std
 	return -1;
 	}
 
-std::pair<bool, IntrusivePtr<Val>>
+std::pair<bool, zeek::IntrusivePtr<Val>>
 Plugin::HookFunctionCall(const Func* func, Frame* parent,
                          zeek::Args* args)
 	{
@@ -390,9 +390,9 @@ Plugin::HookFunctionCall(const Func* func, Frame* parent,
 #pragma GCC diagnostic pop
 
 	for ( auto i = 0u; i < args->size(); ++i )
-		(*args)[i] = {AdoptRef{}, vlargs[i]};
+		(*args)[i] = {zeek::AdoptRef{}, vlargs[i]};
 
-	return {handled, {AdoptRef{}, result}};
+	return {handled, {zeek::AdoptRef{}, result}};
 	}
 
 std::pair<bool, Val*> Plugin::HookCallFunction(const Func* func, Frame *parent, val_list* args)
diff --git a/src/plugin/Plugin.h b/src/plugin/Plugin.h
index 493fb21742..b46bae6b10 100644
--- a/src/plugin/Plugin.h
+++ b/src/plugin/Plugin.h
@@ -20,7 +20,10 @@ class ODesc;
 class Frame;
 class Func;
 class Event;
+
+namespace zeek {
 template <class T> class IntrusivePtr;
+}
 
 namespace threading {
 struct Field;
@@ -668,7 +671,7 @@ protected:
 	 * interpreter. If the plugin did not handle the call, it must return a
 	 * pair with the first member set to 'false' and null result value.
 	 */
-	virtual std::pair<bool, IntrusivePtr<Val>>
+	virtual std::pair<bool, zeek::IntrusivePtr<Val>>
 	HookFunctionCall(const Func* func, Frame* parent, zeek::Args* args);
 
 	[[deprecated("Remove in v4.1.  Use HookFunctionCall()")]]
diff --git a/src/probabilistic/Topk.cc b/src/probabilistic/Topk.cc
index 1cd1027b1e..6faa2d5c70 100644
--- a/src/probabilistic/Topk.cc
+++ b/src/probabilistic/Topk.cc
@@ -18,11 +18,11 @@ static void topk_element_hash_delete_func(void* val)
 	delete e;
 	}
 
-void TopkVal::Typify(IntrusivePtr<zeek::Type> t)
+void TopkVal::Typify(zeek::IntrusivePtr<zeek::Type> t)
 	{
 	assert(!hash && !type);
 	type = std::move(t);
-	auto tl = make_intrusive<zeek::TypeList>(type);
+	auto tl = zeek::make_intrusive<zeek::TypeList>(type);
 	tl->Append(type);
 	hash = new CompositeHash(std::move(tl));
 	}
@@ -176,14 +176,14 @@ void TopkVal::Merge(const TopkVal* value, bool doPrune)
 		}
 	}
 
-IntrusivePtr<Val> TopkVal::DoClone(CloneState* state)
+zeek::IntrusivePtr<Val> TopkVal::DoClone(CloneState* state)
 	{
-	auto clone = make_intrusive<TopkVal>(size);
+	auto clone = zeek::make_intrusive<TopkVal>(size);
 	clone->Merge(this);
 	return state->NewClone(this, std::move(clone));
 	}
 
-IntrusivePtr<VectorVal> TopkVal::GetTopK(int k) const // returns vector
+zeek::IntrusivePtr<VectorVal> TopkVal::GetTopK(int k) const // returns vector
 	{
 	if ( numElements == 0 )
 		{
@@ -191,8 +191,8 @@ IntrusivePtr<VectorVal> TopkVal::GetTopK(int k) const // returns vector
 		return nullptr;
 		}
 
-	auto v = make_intrusive<zeek::VectorType>(type);
-	auto t = make_intrusive<VectorVal>(std::move(v));
+	auto v = zeek::make_intrusive<zeek::VectorType>(type);
+	auto t = zeek::make_intrusive<VectorVal>(std::move(v));
 
 	// this does no estimation if the results is correct!
 	// in any case - just to make this future-proof (and I am lazy) - this can return more than k.
@@ -269,7 +269,7 @@ uint64_t TopkVal::GetSum() const
 	return sum;
 	}
 
-void TopkVal::Encountered(IntrusivePtr<Val> encountered)
+void TopkVal::Encountered(zeek::IntrusivePtr<Val> encountered)
 	{
 	// ok, let's see if we already know this one.
 
diff --git a/src/probabilistic/Topk.h b/src/probabilistic/Topk.h
index 24db217a59..1f008b4638 100644
--- a/src/probabilistic/Topk.h
+++ b/src/probabilistic/Topk.h
@@ -27,7 +27,7 @@ struct Bucket {
 
 struct Element {
 	uint64_t epsilon;
-	IntrusivePtr<Val> value;
+	zeek::IntrusivePtr<Val> value;
 	Bucket* parent;
 };
 
@@ -55,7 +55,7 @@ public:
 	 *
 	 * @param value The encountered element
 	 */
-	void Encountered(IntrusivePtr<Val> value);
+	void Encountered(zeek::IntrusivePtr<Val> value);
 
 	/**
 	 * Get the first *k* elements of the result vector. At the moment,
@@ -66,7 +66,7 @@ public:
 	 *
 	 * @returns The top-k encountered elements
 	 */
-	IntrusivePtr<VectorVal> GetTopK(int k) const;
+	zeek::IntrusivePtr<VectorVal> GetTopK(int k) const;
 
 	/**
 	 * Get the current count tracked in the top-k data structure for a
@@ -125,7 +125,7 @@ public:
 	 *
 	 * @returns cloned TopkVal
 	 */
-	IntrusivePtr<Val> DoClone(CloneState* state) override;
+	zeek::IntrusivePtr<Val> DoClone(CloneState* state) override;
 
 	DECLARE_OPAQUE_VALUE(TopkVal)
 
@@ -153,7 +153,7 @@ private:
 	 * @returns HashKey for value
 	 */
 	HashKey* GetHash(Val* v) const; // this probably should go somewhere else.
-	HashKey* GetHash(const IntrusivePtr<Val>& v) const
+	HashKey* GetHash(const zeek::IntrusivePtr<Val>& v) const
 		{ return GetHash(v.get()); }
 
 	/**
@@ -161,9 +161,9 @@ private:
 	 *
 	 * @param t type that is tracked
 	 */
-	void Typify(IntrusivePtr<zeek::Type> t);
+	void Typify(zeek::IntrusivePtr<zeek::Type> t);
 
-	IntrusivePtr<zeek::Type> type;
+	zeek::IntrusivePtr<zeek::Type> type;
 	CompositeHash* hash;
 	std::list<Bucket*> buckets;
 	PDict<Element>* elementDict;
diff --git a/src/probabilistic/bloom-filter.bif b/src/probabilistic/bloom-filter.bif
index b8c4592c8d..f9cfc56885 100644
--- a/src/probabilistic/bloom-filter.bif
+++ b/src/probabilistic/bloom-filter.bif
@@ -46,7 +46,7 @@ function bloomfilter_basic_init%(fp: double, capacity: count,
                                  name->Len());
 	const Hasher* h = new DoubleHasher(optimal_k, seed);
 
-	return make_intrusive<BloomFilterVal>(new BasicBloomFilter(h, cells));
+	return zeek::make_intrusive<BloomFilterVal>(new BasicBloomFilter(h, cells));
 	%}
 
 ## Creates a basic Bloom filter. This function serves as a low-level
@@ -86,7 +86,7 @@ function bloomfilter_basic_init2%(k: count, cells: count,
 				       name->Len());
 	const Hasher* h = new DoubleHasher(k, seed);
 
-	return make_intrusive<BloomFilterVal>(new BasicBloomFilter(h, cells));
+	return zeek::make_intrusive<BloomFilterVal>(new BasicBloomFilter(h, cells));
 	%}
 
 ## Creates a counting Bloom filter.
@@ -130,7 +130,7 @@ function bloomfilter_counting_init%(k: count, cells: count, max: count,
 	while ( max >>= 1 )
 		++width;
 
-	return make_intrusive<BloomFilterVal>(new CountingBloomFilter(h, cells, width));
+	return zeek::make_intrusive<BloomFilterVal>(new CountingBloomFilter(h, cells, width));
 	%}
 
 ## Adds an element to a Bloom filter.
@@ -139,8 +139,8 @@ function bloomfilter_counting_init%(k: count, cells: count, max: count,
 ##
 ## x: The element to add.
 ##
-## .. zeek:see:: bloomfilter_basic_init bloomfilter_basic_init2 
-##    bloomfilter_counting_init bloomfilter_lookup bloomfilter_clear 
+## .. zeek:see:: bloomfilter_basic_init bloomfilter_basic_init2
+##    bloomfilter_counting_init bloomfilter_lookup bloomfilter_clear
 ##    bloomfilter_merge
 function bloomfilter_add%(bf: opaque of bloomfilter, x: any%): any
 	%{
@@ -238,12 +238,12 @@ function bloomfilter_merge%(bf1: opaque of bloomfilter,
 
 ## Returns a string with a representation of a Bloom filter's internal
 ## state. This is for debugging/testing purposes only.
-## 
+##
 ## bf: The Bloom filter handle.
 ##
 ## Returns: a string with a representation of a Bloom filter's internal state.
 function bloomfilter_internal_state%(bf: opaque of bloomfilter%): string
 	%{
 	BloomFilterVal* bfv = static_cast<BloomFilterVal*>(bf);
-	return make_intrusive<StringVal>(bfv->InternalState());
+	return zeek::make_intrusive<StringVal>(bfv->InternalState());
 	%}
diff --git a/src/probabilistic/cardinality-counter.bif b/src/probabilistic/cardinality-counter.bif
index 6b4804b748..a8f67bed87 100644
--- a/src/probabilistic/cardinality-counter.bif
+++ b/src/probabilistic/cardinality-counter.bif
@@ -23,7 +23,7 @@ module GLOBAL;
 function hll_cardinality_init%(err: double, confidence: double%): opaque of cardinality
 	%{
 	CardinalityCounter* c = new CardinalityCounter(err, confidence);
-	auto cv = make_intrusive<CardinalityVal>(c);
+	auto cv = zeek::make_intrusive<CardinalityVal>(c);
 
 	return cv;
 	%}
@@ -113,7 +113,7 @@ function hll_cardinality_estimate%(handle: opaque of cardinality%): double
 
 	double estimate = h->Size();
 
-	return make_intrusive<DoubleVal>(estimate);
+	return zeek::make_intrusive<DoubleVal>(estimate);
 	%}
 
 ## Copy a HLL cardinality counter.
@@ -129,7 +129,7 @@ function hll_cardinality_copy%(handle: opaque of cardinality%): opaque of cardin
 	CardinalityVal* cv = static_cast<CardinalityVal*>(handle);
 	CardinalityCounter* h = cv->Get();
 	CardinalityCounter* h2 = new CardinalityCounter(*h);
-	auto out = make_intrusive<CardinalityVal>(h2);
+	auto out = zeek::make_intrusive<CardinalityVal>(h2);
 
 	return out;
 	%}
diff --git a/src/probabilistic/top-k.bif b/src/probabilistic/top-k.bif
index 947b514c08..cc2e954a68 100644
--- a/src/probabilistic/top-k.bif
+++ b/src/probabilistic/top-k.bif
@@ -14,7 +14,7 @@
 ##    topk_size topk_sum topk_merge topk_merge_prune
 function topk_init%(size: count%): opaque of topk
 	%{
-	auto v = make_intrusive<probabilistic::TopkVal>(size);
+	auto v = zeek::make_intrusive<probabilistic::TopkVal>(size);
 	return v;
 	%}
 
@@ -34,7 +34,7 @@ function topk_add%(handle: opaque of topk, value: any%): any
 	%{
 	assert(handle);
 	probabilistic::TopkVal* h = (probabilistic::TopkVal*) handle;
-	h->Encountered({NewRef{}, value});
+	h->Encountered({zeek::NewRef{}, value});
 
 	return nullptr;
 	%}
diff --git a/src/reporter.bif b/src/reporter.bif
index 2133bd7d00..49008aafec 100644
--- a/src/reporter.bif
+++ b/src/reporter.bif
@@ -163,10 +163,10 @@ function Reporter::file_weird%(name: string, f: fa_file, addl: string &default="
 ## Returns: Current weird sampling whitelist
 function Reporter::get_weird_sampling_whitelist%(%): string_set
 	%{
-	auto set = make_intrusive<TableVal>(zeek::id::string_set);
+	auto set = zeek::make_intrusive<TableVal>(zeek::id::string_set);
 	for ( auto el : reporter->GetWeirdSamplingWhitelist() )
 		{
-		auto idx = make_intrusive<StringVal>(el);
+		auto idx = zeek::make_intrusive<StringVal>(el);
 		set->Assign(std::move(idx), nullptr);
 		}
 	return set;
@@ -242,7 +242,7 @@ function Reporter::set_weird_sampling_rate%(weird_sampling_rate: count%) : bool
 ## Returns: weird sampling duration.
 function Reporter::get_weird_sampling_duration%(%) : interval
 	%{
-	return make_intrusive<IntervalVal>(reporter->GetWeirdSamplingDuration());
+	return zeek::make_intrusive<IntervalVal>(reporter->GetWeirdSamplingDuration());
 	%}
 
 ## Sets the current weird sampling duration. Please note that
diff --git a/src/scan.l b/src/scan.l
index abc3247e71..41129ead9a 100644
--- a/src/scan.l
+++ b/src/scan.l
@@ -749,7 +749,7 @@ void do_atif(zeek::detail::Expr* expr)
 
 	LocalNameFinder cb;
 	expr->Traverse(&cb);
-	IntrusivePtr<Val> val;
+	zeek::IntrusivePtr<Val> val;
 
 	if ( cb.local_names.empty() )
 		val = expr->Eval(nullptr);
diff --git a/src/stats.bif b/src/stats.bif
index 901f62a223..96780b344c 100644
--- a/src/stats.bif
+++ b/src/stats.bif
@@ -4,19 +4,19 @@
 #include "threading/Manager.h"
 #include "broker/Manager.h"
 
-IntrusivePtr<zeek::RecordType> ProcStats;
-IntrusivePtr<zeek::RecordType> NetStats;
-IntrusivePtr<zeek::RecordType> MatcherStats;
-IntrusivePtr<zeek::RecordType> ReassemblerStats;
-IntrusivePtr<zeek::RecordType> DNSStats;
-IntrusivePtr<zeek::RecordType> ConnStats;
-IntrusivePtr<zeek::RecordType> GapStats;
-IntrusivePtr<zeek::RecordType> EventStats;
-IntrusivePtr<zeek::RecordType> ThreadStats;
-IntrusivePtr<zeek::RecordType> TimerStats;
-IntrusivePtr<zeek::RecordType> FileAnalysisStats;
-IntrusivePtr<zeek::RecordType> BrokerStats;
-IntrusivePtr<zeek::RecordType> ReporterStats;
+zeek::IntrusivePtr<zeek::RecordType> ProcStats;
+zeek::IntrusivePtr<zeek::RecordType> NetStats;
+zeek::IntrusivePtr<zeek::RecordType> MatcherStats;
+zeek::IntrusivePtr<zeek::RecordType> ReassemblerStats;
+zeek::IntrusivePtr<zeek::RecordType> DNSStats;
+zeek::IntrusivePtr<zeek::RecordType> ConnStats;
+zeek::IntrusivePtr<zeek::RecordType> GapStats;
+zeek::IntrusivePtr<zeek::RecordType> EventStats;
+zeek::IntrusivePtr<zeek::RecordType> ThreadStats;
+zeek::IntrusivePtr<zeek::RecordType> TimerStats;
+zeek::IntrusivePtr<zeek::RecordType> FileAnalysisStats;
+zeek::IntrusivePtr<zeek::RecordType> BrokerStats;
+zeek::IntrusivePtr<zeek::RecordType> ReporterStats;
 %%}
 
 ## Returns packet capture statistics. Statistics include the number of
@@ -54,7 +54,7 @@ function get_net_stats%(%): NetStats
 		bytes_recv += stat.bytes_received;
 		}
 
-	auto r = make_intrusive<RecordVal>(NetStats);
+	auto r = zeek::make_intrusive<RecordVal>(NetStats);
 	int n = 0;
 
 	r->Assign(n++, val_mgr->Count(recv));
@@ -83,7 +83,7 @@ function get_net_stats%(%): NetStats
 ##              get_reporter_stats
 function get_conn_stats%(%): ConnStats
 	%{
-	auto r = make_intrusive<RecordVal>(ConnStats);
+	auto r = zeek::make_intrusive<RecordVal>(ConnStats);
 	int n = 0;
 
 	r->Assign(n++, val_mgr->Count(Connection::TotalConnections()));
@@ -137,7 +137,7 @@ function get_proc_stats%(%): ProcStats
 	if ( getrusage(RUSAGE_SELF, &ru) < 0 )
 		reporter->InternalError("getrusage() failed in get_proc_stats()");
 
-	auto r = make_intrusive<RecordVal>(ProcStats);
+	auto r = zeek::make_intrusive<RecordVal>(ProcStats);
 	int n = 0;
 
 	double elapsed_time = current_time() - bro_start_time;
@@ -152,11 +152,11 @@ function get_proc_stats%(%): ProcStats
 	r->Assign(n++, val_mgr->Count(0));
 #endif
 
-	r->Assign(n++, make_intrusive<TimeVal>(bro_start_time));
+	r->Assign(n++, zeek::make_intrusive<TimeVal>(bro_start_time));
 
-	r->Assign(n++, make_intrusive<IntervalVal>(elapsed_time, Seconds));
-	r->Assign(n++, make_intrusive<IntervalVal>(user_time, Seconds));
-	r->Assign(n++, make_intrusive<IntervalVal>(system_time, Seconds));
+	r->Assign(n++, zeek::make_intrusive<IntervalVal>(elapsed_time, Seconds));
+	r->Assign(n++, zeek::make_intrusive<IntervalVal>(user_time, Seconds));
+	r->Assign(n++, zeek::make_intrusive<IntervalVal>(system_time, Seconds));
 
 	uint64_t total_mem;
 	get_memory_usage(&total_mem, NULL);
@@ -190,7 +190,7 @@ function get_proc_stats%(%): ProcStats
 ##              get_reporter_stats
 function get_event_stats%(%): EventStats
 	%{
-	auto r = make_intrusive<RecordVal>(EventStats);
+	auto r = zeek::make_intrusive<RecordVal>(EventStats);
 	int n = 0;
 
 	r->Assign(n++, val_mgr->Count(num_events_queued));
@@ -217,7 +217,7 @@ function get_event_stats%(%): EventStats
 ##              get_reporter_stats
 function get_reassembler_stats%(%): ReassemblerStats
 	%{
-	auto r = make_intrusive<RecordVal>(ReassemblerStats);
+	auto r = zeek::make_intrusive<RecordVal>(ReassemblerStats);
 	int n = 0;
 
 	r->Assign(n++, val_mgr->Count(Reassembler::MemoryAllocation(REASSEM_FILE)));
@@ -246,7 +246,7 @@ function get_reassembler_stats%(%): ReassemblerStats
 ##              get_reporter_stats
 function get_dns_stats%(%): DNSStats
 	%{
-	auto r = make_intrusive<RecordVal>(DNSStats);
+	auto r = zeek::make_intrusive<RecordVal>(DNSStats);
 	int n = 0;
 
 	DNS_Mgr::Stats dstats;
@@ -280,7 +280,7 @@ function get_dns_stats%(%): DNSStats
 ##              get_reporter_stats
 function get_timer_stats%(%): TimerStats
 	%{
-	auto r = make_intrusive<RecordVal>(TimerStats);
+	auto r = zeek::make_intrusive<RecordVal>(TimerStats);
 	int n = 0;
 
 	r->Assign(n++, val_mgr->Count(unsigned(timer_mgr->Size())));
@@ -308,7 +308,7 @@ function get_timer_stats%(%): TimerStats
 ##              get_reporter_stats
 function get_file_analysis_stats%(%): FileAnalysisStats
 	%{
-	auto r = make_intrusive<RecordVal>(FileAnalysisStats);
+	auto r = zeek::make_intrusive<RecordVal>(FileAnalysisStats);
 	int n = 0;
 
 	r->Assign(n++, val_mgr->Count(file_mgr->CurrentFiles()));
@@ -336,7 +336,7 @@ function get_file_analysis_stats%(%): FileAnalysisStats
 ##              get_reporter_stats
 function get_thread_stats%(%): ThreadStats
 	%{
-	auto r = make_intrusive<RecordVal>(ThreadStats);
+	auto r = zeek::make_intrusive<RecordVal>(ThreadStats);
 	int n = 0;
 
 	r->Assign(n++, val_mgr->Count(thread_mgr->NumThreads()));
@@ -362,7 +362,7 @@ function get_thread_stats%(%): ThreadStats
 ##              get_reporter_stats
 function get_gap_stats%(%): GapStats
 	%{
-	auto r = make_intrusive<RecordVal>(GapStats);
+	auto r = zeek::make_intrusive<RecordVal>(GapStats);
 	int n = 0;
 
 	r->Assign(n++, val_mgr->Count(tot_ack_events));
@@ -394,7 +394,7 @@ function get_gap_stats%(%): GapStats
 ##              get_reporter_stats
 function get_matcher_stats%(%): MatcherStats
 	%{
-	auto r = make_intrusive<RecordVal>(MatcherStats);
+	auto r = zeek::make_intrusive<RecordVal>(MatcherStats);
 	int n = 0;
 
 	RuleMatcher::Stats s;
@@ -432,7 +432,7 @@ function get_matcher_stats%(%): MatcherStats
 ##              get_reporter_stats
 function get_broker_stats%(%): BrokerStats
 	%{
-	auto r = make_intrusive<RecordVal>(BrokerStats);
+	auto r = zeek::make_intrusive<RecordVal>(BrokerStats);
 	int n = 0;
 
 	auto cs = broker_mgr->GetStatistics();
@@ -467,14 +467,14 @@ function get_broker_stats%(%): BrokerStats
 ##              get_broker_stats
 function get_reporter_stats%(%): ReporterStats
 	%{
-	auto r = make_intrusive<RecordVal>(ReporterStats);
+	auto r = zeek::make_intrusive<RecordVal>(ReporterStats);
 	int n = 0;
 
-	auto weirds_by_type = make_intrusive<TableVal>(zeek::id::find_type<TableType>("table_string_of_count"));
+	auto weirds_by_type = zeek::make_intrusive<TableVal>(zeek::id::find_type<TableType>("table_string_of_count"));
 
 	for ( auto& kv : reporter->GetWeirdsByType() )
 		{
-		auto weird = make_intrusive<StringVal>(kv.first);
+		auto weird = zeek::make_intrusive<StringVal>(kv.first);
 		weirds_by_type->Assign(std::move(weird), val_mgr->Count(kv.second));
 		}
 
diff --git a/src/strings.bif b/src/strings.bif
index 909280b564..e450f65e93 100644
--- a/src/strings.bif
+++ b/src/strings.bif
@@ -75,7 +75,7 @@ function string_cat%(...%): string
 		}
 	*b = 0;
 
-	return make_intrusive<StringVal>(s);
+	return zeek::make_intrusive<StringVal>(s);
 	%}
 
 ## Joins all values in the given vector of strings with a separator placed
@@ -114,7 +114,7 @@ function join_string_vec%(vec: string_vec, sep: string%): string
 	BroString* s = new BroString(1, d.TakeBytes(), d.Len());
 	s->SetUseFreeToDelete(true);
 
-	return make_intrusive<StringVal>(s);
+	return zeek::make_intrusive<StringVal>(s);
 	%}
 
 ## Returns an edited version of a string that applies a special
@@ -162,7 +162,7 @@ function edit%(arg_s: string, arg_edit_char: string%): string
 
 	new_s[ind] = '\0';
 
-	return make_intrusive<StringVal>(new BroString(1, byte_vec(new_s), ind));
+	return zeek::make_intrusive<StringVal>(new BroString(1, byte_vec(new_s), ind));
 	%}
 
 ## Get a substring from a string, given a starting position and length.
@@ -185,7 +185,7 @@ function sub_bytes%(s: string, start: count, n: int%): string
 	if ( ! ss )
 		ss = new BroString("");
 
-	return make_intrusive<StringVal>(ss);
+	return zeek::make_intrusive<StringVal>(ss);
 	%}
 
 %%{
@@ -199,12 +199,12 @@ static int match_prefix(int s_len, const char* s, int t_len, const char* t)
 	return 1;
 	}
 
-static IntrusivePtr<VectorVal> do_split_string(StringVal* str_val,
+static zeek::IntrusivePtr<VectorVal> do_split_string(StringVal* str_val,
                                                RE_Matcher* re, int incl_sep,
                                                int max_num_sep)
 	{
 	// string_vec is used early in the version script - do not use the NetVar.
-	auto rval = make_intrusive<VectorVal>(zeek::id::find_type<zeek::VectorType>("string_vec"));
+	auto rval = zeek::make_intrusive<VectorVal>(zeek::id::find_type<zeek::VectorType>("string_vec"));
 	const u_char* s = str_val->Bytes();
 	int n = str_val->Len();
 	const u_char* end_of_s = s + n;
@@ -231,7 +231,7 @@ static IntrusivePtr<VectorVal> do_split_string(StringVal* str_val,
 			n=0;
 			}
 
-		rval->Assign(num++, make_intrusive<StringVal>(offset, (const char*) s));
+		rval->Assign(num++, zeek::make_intrusive<StringVal>(offset, (const char*) s));
 
 		// No more separators will be needed if this is the end of string.
 		if ( n <= 0 )
@@ -239,7 +239,7 @@ static IntrusivePtr<VectorVal> do_split_string(StringVal* str_val,
 
 		if ( incl_sep )
 			{ // including the part that matches the pattern
-			rval->Assign(num++, make_intrusive<StringVal>(end_of_match, (const char*) s+offset));
+			rval->Assign(num++, zeek::make_intrusive<StringVal>(end_of_match, (const char*) s+offset));
 			}
 
 		if ( max_num_sep && num_sep >= max_num_sep )
@@ -287,7 +287,7 @@ Val* do_split(StringVal* str_val, RE_Matcher* re, int incl_sep, int max_num_sep)
 			}
 
 		auto ind = val_mgr->Count(++num);
-		a->Assign(std::move(ind), make_intrusive<StringVal>(offset, (const char*) s));
+		a->Assign(std::move(ind), zeek::make_intrusive<StringVal>(offset, (const char*) s));
 
 		// No more separators will be needed if this is the end of string.
 		if ( n <= 0 )
@@ -296,7 +296,7 @@ Val* do_split(StringVal* str_val, RE_Matcher* re, int incl_sep, int max_num_sep)
 		if ( incl_sep )
 			{ // including the part that matches the pattern
 			ind = val_mgr->Count(++num);
-			a->Assign(std::move(ind), make_intrusive<StringVal>(end_of_match, (const char*) s+offset));
+			a->Assign(std::move(ind), zeek::make_intrusive<StringVal>(end_of_match, (const char*) s+offset));
 			}
 
 		if ( max_num_sep && num_sep >= max_num_sep )
@@ -477,7 +477,7 @@ function subst_string%(s: string, from: string, to: string%): string
 	%{
 	const int little_len = from->Len();
 	if ( little_len == 0 )
-		return IntrusivePtr{NewRef{}, s};
+		return IntrusivePtr{zeek::NewRef{}, s};
 
 	int big_len = s->Len();
 	const u_char* big = s->Bytes();
@@ -512,7 +512,7 @@ function subst_string%(s: string, from: string, to: string%): string
 		vs.push_back(dc);
 		}
 
-	return make_intrusive<StringVal>(concatenate(vs));
+	return zeek::make_intrusive<StringVal>(concatenate(vs));
 	%}
 
 ## Replaces all uppercase letters in a string with their lowercase counterpart.
@@ -541,7 +541,7 @@ function to_lower%(str: string%): string
 
     *ls++ = '\0';
 
-	return make_intrusive<StringVal>(new BroString(1, lower_s, n));
+	return zeek::make_intrusive<StringVal>(new BroString(1, lower_s, n));
 	%}
 
 ## Replaces all lowercase letters in a string with their uppercase counterpart.
@@ -570,7 +570,7 @@ function to_upper%(str: string%): string
 
     *us++ = '\0';
 
-	return make_intrusive<StringVal>(new BroString(1, upper_s, n));
+	return zeek::make_intrusive<StringVal>(new BroString(1, upper_s, n));
 	%}
 
 ## Replaces non-printable characters in a string with escaped sequences. The
@@ -590,7 +590,7 @@ function to_upper%(str: string%): string
 function clean%(str: string%): string
 	%{
 	char* s = str->AsString()->Render();
-	return make_intrusive<StringVal>(new BroString(1, byte_vec(s), strlen(s)));
+	return zeek::make_intrusive<StringVal>(new BroString(1, byte_vec(s), strlen(s)));
 	%}
 
 ## Replaces non-printable characters in a string with escaped sequences. The
@@ -608,7 +608,7 @@ function clean%(str: string%): string
 function to_string_literal%(str: string%): string
 	%{
 	char* s = str->AsString()->Render(BroString::BRO_STRING_LITERAL);
-	return make_intrusive<StringVal>(new BroString(1, byte_vec(s), strlen(s)));
+	return zeek::make_intrusive<StringVal>(new BroString(1, byte_vec(s), strlen(s)));
 	%}
 
 ## Determines whether a given string contains only ASCII characters.
@@ -647,7 +647,7 @@ function is_ascii%(str: string%): bool
 function escape_string%(s: string%): string
 	%{
 	char* escstr = s->AsString()->Render(BroString::ESC_HEX | BroString::ESC_ESC);
-	auto val = make_intrusive<StringVal>(escstr);
+	auto val = zeek::make_intrusive<StringVal>(escstr);
 	delete [] escstr;
 	return val;
 	%}
@@ -666,7 +666,7 @@ function string_to_ascii_hex%(s: string%): string
 	for ( int i = 0; i < s->Len(); ++i )
 		sprintf(x + i * 2, "%02x", sp[i]);
 
-	return make_intrusive<StringVal>(new BroString(1, (u_char*) x, s->Len() * 2));
+	return zeek::make_intrusive<StringVal>(new BroString(1, (u_char*) x, s->Len() * 2));
 	%}
 
 ## Uses the Smith-Waterman algorithm to find similar/overlapping substrings.
@@ -686,7 +686,7 @@ function str_smith_waterman%(s1: string, s2: string, params: sw_params%) : sw_su
 
 	BroSubstring::Vec* subseq =
 		smith_waterman(s1->AsString(), s2->AsString(), sw_params);
-	auto result = IntrusivePtr<VectorVal>{AdoptRef{}, BroSubstring::VecToPolicy(subseq)};
+	auto result = zeek::IntrusivePtr<VectorVal>{zeek::AdoptRef{}, BroSubstring::VecToPolicy(subseq)};
 	delete_each(subseq);
 	delete subseq;
 
@@ -713,7 +713,7 @@ function str_split%(s: string, idx: index_vec%): string_vec
 		indices[i] = (*idx_v)[i]->AsCount();
 
 	BroString::Vec* result = s->AsString()->Split(indices);
-	auto result_v = make_intrusive<VectorVal>(zeek::id::string_vec);
+	auto result_v = zeek::make_intrusive<VectorVal>(zeek::id::string_vec);
 
 	if ( result )
 		{
@@ -721,7 +721,7 @@ function str_split%(s: string, idx: index_vec%): string_vec
 
 		for ( BroString::VecIt it = result->begin();
 		      it != result->end(); ++it, ++i )
-			result_v->Assign(i, make_intrusive<StringVal>(*it));
+			result_v->Assign(i, zeek::make_intrusive<StringVal>(*it));
 			// StringVal now possesses string.
 
 		delete result;
@@ -744,7 +744,7 @@ function strip%(str: string%): string
 
 	if ( n == 0 )
 		// Empty string.
-		return make_intrusive<StringVal>(new BroString(s, n, 1));
+		return zeek::make_intrusive<StringVal>(new BroString(s, n, 1));
 
 	const u_char* sp = s;
 
@@ -757,7 +757,7 @@ function strip%(str: string%): string
 	while ( isspace(*sp) && sp <= e )
 		++sp;
 
-	return make_intrusive<StringVal>(new BroString(sp, (e - sp + 1), 1));
+	return zeek::make_intrusive<StringVal>(new BroString(sp, (e - sp + 1), 1));
 	%}
 
 %%{
@@ -792,7 +792,7 @@ function lstrip%(str: string, chars: string &default=" \t\n\r\v\f"%): string
 
 	// empty input string
 	if ( n == 0 )
-		return make_intrusive<StringVal>(new BroString(s, n, 1));
+		return zeek::make_intrusive<StringVal>(new BroString(s, n, 1));
 
 	int i;
 	auto bs_chars = chars->AsString();
@@ -801,7 +801,7 @@ function lstrip%(str: string, chars: string &default=" \t\n\r\v\f"%): string
 		if ( ! should_strip(s[i], bs_chars) )
 			break;
 
-	return make_intrusive<StringVal>(new BroString(s + i, n - i, 1));
+	return zeek::make_intrusive<StringVal>(new BroString(s + i, n - i, 1));
 	%}
 
 ## Removes all combinations of characters in the *chars* argument
@@ -823,7 +823,7 @@ function rstrip%(str: string, chars: string &default=" \t\n\r\v\f"%): string
 
 	// empty input string
 	if ( n == 0 )
-		return make_intrusive<StringVal>(new BroString(s, n, 1));
+		return zeek::make_intrusive<StringVal>(new BroString(s, n, 1));
 
 	int n_to_remove;
 	auto bs_chars = chars->AsString();
@@ -832,7 +832,7 @@ function rstrip%(str: string, chars: string &default=" \t\n\r\v\f"%): string
 		if ( ! should_strip(s[n - n_to_remove - 1], bs_chars) )
 			break;
 
-	return make_intrusive<StringVal>(new BroString(s, n - n_to_remove, 1));
+	return zeek::make_intrusive<StringVal>(new BroString(s, n - n_to_remove, 1));
 	%}
 
 ## Generates a string of a given size and fills it with repetitions of a source
@@ -854,7 +854,7 @@ function string_fill%(len: int, source: string%): string
 
 	dst[len - 1] = 0;
 
-	return make_intrusive<StringVal>(new BroString(1, byte_vec(dst), len));
+	return zeek::make_intrusive<StringVal>(new BroString(1, byte_vec(dst), len));
 	%}
 
 ## Takes a string and escapes characters that would allow execution of
@@ -894,7 +894,7 @@ function safe_shell_quote%(source: string%): string
 
 	dst[j++] = '"';
 	dst[j] = '\0';
-	return make_intrusive<StringVal>(new BroString(1, dst, j));
+	return zeek::make_intrusive<StringVal>(new BroString(1, dst, j));
 	%}
 
 ## Finds all occurrences of a pattern in a string.
@@ -908,7 +908,7 @@ function safe_shell_quote%(source: string%): string
 ## .. zeek:see: find_last strstr
 function find_all%(str: string, re: pattern%) : string_set
 	%{
-	auto a = make_intrusive<TableVal>(zeek::id::string_set);
+	auto a = zeek::make_intrusive<TableVal>(zeek::id::string_set);
 
 	const u_char* s = str->Bytes();
 	const u_char* e = s + str->Len();
@@ -918,7 +918,7 @@ function find_all%(str: string, re: pattern%) : string_set
 		int n = re->MatchPrefix(t, e - t);
 		if ( n >= 0 )
 			{
-			auto idx = make_intrusive<StringVal>(n, (const char*) t);
+			auto idx = zeek::make_intrusive<StringVal>(n, (const char*) t);
 			a->Assign(std::move(idx), 0);
 			t += n - 1;
 			}
@@ -948,7 +948,7 @@ function find_last%(str: string, re: pattern%) : string
 		{
 		int n = re->MatchPrefix(t, e - t);
 		if ( n >= 0 )
-			return make_intrusive<StringVal>(n, (const char*) t);
+			return zeek::make_intrusive<StringVal>(n, (const char*) t);
 		}
 
 	return val_mgr->EmptyString();
@@ -1066,7 +1066,7 @@ function hexdump%(data_str: string%) : string
 		*ascii_ptr++ = '\n';
 	*ascii_ptr = 0;
 
-	auto result = make_intrusive<StringVal>((const char*) hex_data);
+	auto result = zeek::make_intrusive<StringVal>((const char*) hex_data);
 	delete [] hex_data;
 
 	return result;
@@ -1082,5 +1082,5 @@ function reverse%(str: string%) : string
 	%{
 	string s = string((const char*)str->Bytes(), str->Len());
 	reverse(s.begin(), s.end());
-	return make_intrusive<StringVal>(s.length(), (const char*)s.c_str());
+	return zeek::make_intrusive<StringVal>(s.length(), (const char*)s.c_str());
 	%}
diff --git a/src/supervisor/Supervisor.cc b/src/supervisor/Supervisor.cc
index bcf9a1c9f6..73353e4fc6 100644
--- a/src/supervisor/Supervisor.cc
+++ b/src/supervisor/Supervisor.cc
@@ -1102,53 +1102,53 @@ std::string Supervisor::NodeConfig::ToJSON() const
 	return ToRecord()->ToJSON(false, re.get())->ToStdString();
 	}
 
-IntrusivePtr<RecordVal> Supervisor::NodeConfig::ToRecord() const
+zeek::IntrusivePtr<RecordVal> Supervisor::NodeConfig::ToRecord() const
 	{
 	const auto& rt = zeek::BifType::Record::Supervisor::NodeConfig;
-	auto rval = make_intrusive<RecordVal>(rt);
-	rval->Assign(rt->FieldOffset("name"), make_intrusive<StringVal>(name));
+	auto rval = zeek::make_intrusive<RecordVal>(rt);
+	rval->Assign(rt->FieldOffset("name"), zeek::make_intrusive<StringVal>(name));
 
 	if ( interface )
-		rval->Assign(rt->FieldOffset("interface"), make_intrusive<StringVal>(*interface));
+		rval->Assign(rt->FieldOffset("interface"), zeek::make_intrusive<StringVal>(*interface));
 
 	if ( directory )
-		rval->Assign(rt->FieldOffset("directory"), make_intrusive<StringVal>(*directory));
+		rval->Assign(rt->FieldOffset("directory"), zeek::make_intrusive<StringVal>(*directory));
 
 	if ( stdout_file )
-		rval->Assign(rt->FieldOffset("stdout_file"), make_intrusive<StringVal>(*stdout_file));
+		rval->Assign(rt->FieldOffset("stdout_file"), zeek::make_intrusive<StringVal>(*stdout_file));
 
 	if ( stderr_file )
-		rval->Assign(rt->FieldOffset("stderr_file"), make_intrusive<StringVal>(*stderr_file));
+		rval->Assign(rt->FieldOffset("stderr_file"), zeek::make_intrusive<StringVal>(*stderr_file));
 
 	if ( cpu_affinity )
 		rval->Assign(rt->FieldOffset("cpu_affinity"), val_mgr->Int(*cpu_affinity));
 
 	auto st = rt->GetFieldType<VectorType>("scripts");
-	auto scripts_val = make_intrusive<VectorVal>(std::move(st));
+	auto scripts_val = zeek::make_intrusive<VectorVal>(std::move(st));
 
 	for ( const auto& s : scripts )
-		scripts_val->Assign(scripts_val->Size(), make_intrusive<StringVal>(s));
+		scripts_val->Assign(scripts_val->Size(), zeek::make_intrusive<StringVal>(s));
 
 	rval->Assign(rt->FieldOffset("scripts"), std::move(scripts_val));
 
 	auto tt = rt->GetFieldType<TableType>("cluster");
-	auto cluster_val = make_intrusive<TableVal>(std::move(tt));
+	auto cluster_val = zeek::make_intrusive<TableVal>(std::move(tt));
 	rval->Assign(rt->FieldOffset("cluster"), cluster_val);
 
 	for ( const auto& e : cluster )
 		{
 		auto& name = e.first;
 		auto& ep = e.second;
-		auto key = make_intrusive<StringVal>(name);
+		auto key = zeek::make_intrusive<StringVal>(name);
 		const auto& ept = zeek::BifType::Record::Supervisor::ClusterEndpoint;
-		auto val = make_intrusive<RecordVal>(ept);
+		auto val = zeek::make_intrusive<RecordVal>(ept);
 
 		val->Assign(ept->FieldOffset("role"), zeek::BifType::Enum::Supervisor::ClusterRole->GetVal(ep.role));
-		val->Assign(ept->FieldOffset("host"), make_intrusive<AddrVal>(ep.host));
+		val->Assign(ept->FieldOffset("host"), zeek::make_intrusive<AddrVal>(ep.host));
 		val->Assign(ept->FieldOffset("p"), val_mgr->Port(ep.port, TRANSPORT_TCP));
 
 		if ( ep.interface )
-			val->Assign(ept->FieldOffset("interface"), make_intrusive<StringVal>(*ep.interface));
+			val->Assign(ept->FieldOffset("interface"), zeek::make_intrusive<StringVal>(*ep.interface));
 
 		cluster_val->Assign(std::move(key), std::move(val));
 		}
@@ -1156,10 +1156,10 @@ IntrusivePtr<RecordVal> Supervisor::NodeConfig::ToRecord() const
 	return rval;
 	}
 
-IntrusivePtr<RecordVal> Supervisor::Node::ToRecord() const
+zeek::IntrusivePtr<RecordVal> Supervisor::Node::ToRecord() const
 	{
 	const auto& rt = zeek::BifType::Record::Supervisor::NodeStatus;
-	auto rval = make_intrusive<RecordVal>(rt);
+	auto rval = zeek::make_intrusive<RecordVal>(rt);
 
 	rval->Assign(rt->FieldOffset("node"), config.ToRecord());
 
@@ -1170,7 +1170,7 @@ IntrusivePtr<RecordVal> Supervisor::Node::ToRecord() const
 	}
 
 
-static IntrusivePtr<Val> supervisor_role_to_cluster_node_type(BifEnum::Supervisor::ClusterRole role)
+static zeek::IntrusivePtr<Val> supervisor_role_to_cluster_node_type(BifEnum::Supervisor::ClusterRole role)
 	{
 	static auto node_type = zeek::id::find_type<zeek::EnumType>("Cluster::NodeType");
 
@@ -1212,21 +1212,21 @@ bool Supervisor::SupervisedNode::InitCluster() const
 		{
 		const auto& node_name = e.first;
 		const auto& ep = e.second;
-		auto key = make_intrusive<StringVal>(node_name);
-		auto val = make_intrusive<RecordVal>(cluster_node_type);
+		auto key = zeek::make_intrusive<StringVal>(node_name);
+		auto val = zeek::make_intrusive<RecordVal>(cluster_node_type);
 
 		auto node_type = supervisor_role_to_cluster_node_type(ep.role);
 		val->Assign(cluster_node_type->FieldOffset("node_type"), std::move(node_type));
-		val->Assign(cluster_node_type->FieldOffset("ip"), make_intrusive<AddrVal>(ep.host));
+		val->Assign(cluster_node_type->FieldOffset("ip"), zeek::make_intrusive<AddrVal>(ep.host));
 		val->Assign(cluster_node_type->FieldOffset("p"), val_mgr->Port(ep.port, TRANSPORT_TCP));
 
 		if ( ep.interface )
 			val->Assign(cluster_node_type->FieldOffset("interface"),
-			            make_intrusive<StringVal>(*ep.interface));
+			            zeek::make_intrusive<StringVal>(*ep.interface));
 
 		if ( manager_name && ep.role != BifEnum::Supervisor::MANAGER )
 			val->Assign(cluster_node_type->FieldOffset("manager"),
-			            make_intrusive<StringVal>(*manager_name));
+			            zeek::make_intrusive<StringVal>(*manager_name));
 
 		cluster_nodes->Assign(std::move(key), std::move(val));
 		}
@@ -1312,11 +1312,11 @@ void Supervisor::SupervisedNode::Init(zeek::Options* options) const
 		options->scripts_to_load.emplace_back(s);
 	}
 
-IntrusivePtr<RecordVal> Supervisor::Status(std::string_view node_name)
+zeek::IntrusivePtr<RecordVal> Supervisor::Status(std::string_view node_name)
 	{
-	auto rval = make_intrusive<RecordVal>(zeek::BifType::Record::Supervisor::Status);
+	auto rval = zeek::make_intrusive<RecordVal>(zeek::BifType::Record::Supervisor::Status);
 	const auto& tt = zeek::BifType::Record::Supervisor::Status->GetFieldType("nodes");
-	auto node_table_val = make_intrusive<TableVal>(cast_intrusive<TableType>(tt));
+	auto node_table_val = zeek::make_intrusive<TableVal>(zeek::cast_intrusive<TableType>(tt));
 	rval->Assign(0, node_table_val);
 
 	if ( node_name.empty() )
@@ -1325,7 +1325,7 @@ IntrusivePtr<RecordVal> Supervisor::Status(std::string_view node_name)
 			{
 			const auto& name = n.first;
 			const auto& node = n.second;
-			auto key = make_intrusive<StringVal>(name);
+			auto key = zeek::make_intrusive<StringVal>(name);
 			auto val = node.ToRecord();
 			node_table_val->Assign(std::move(key), std::move(val));
 			}
@@ -1339,7 +1339,7 @@ IntrusivePtr<RecordVal> Supervisor::Status(std::string_view node_name)
 
 		const auto& name = it->first;
 		const auto& node = it->second;
-		auto key = make_intrusive<StringVal>(name);
+		auto key = zeek::make_intrusive<StringVal>(name);
 		auto val = node.ToRecord();
 		node_table_val->Assign(std::move(key), std::move(val));
 		}
diff --git a/src/supervisor/Supervisor.h b/src/supervisor/Supervisor.h
index ba381ad6dd..1d92d60b77 100644
--- a/src/supervisor/Supervisor.h
+++ b/src/supervisor/Supervisor.h
@@ -103,7 +103,7 @@ public:
 		 * Convert his object into script-layer record value.
 		 * @return  the script-layer record value representing the node config.
 		 */
-		IntrusivePtr<RecordVal> ToRecord() const;
+		zeek::IntrusivePtr<RecordVal> ToRecord() const;
 
 		/**
 		 * The name of the supervised Zeek node.  These are unique within
@@ -183,7 +183,7 @@ public:
 		 * Convert the node into script-layer Supervisor::NodeStatus record
 		 * representation.
 		 */
-		IntrusivePtr<RecordVal> ToRecord() const;
+		zeek::IntrusivePtr<RecordVal> ToRecord() const;
 
 		/**
 		 * @return the name of the node.
@@ -311,7 +311,7 @@ public:
 	 * @return  script-layer Supervisor::Status record value describing the
 	 * status of a node or set of nodes.
 	 */
-	IntrusivePtr<RecordVal> Status(std::string_view node_name);
+	zeek::IntrusivePtr<RecordVal> Status(std::string_view node_name);
 
 	/**
 	 * Create a new supervised node.
diff --git a/src/supervisor/supervisor.bif b/src/supervisor/supervisor.bif
index e0dd3dce3b..4f100812b1 100644
--- a/src/supervisor/supervisor.bif
+++ b/src/supervisor/supervisor.bif
@@ -24,7 +24,7 @@ function Supervisor::__status%(node: string%): Supervisor::Status
 	if ( ! zeek::supervisor_mgr )
 		{
 		builtin_error("supervisor mode not enabled");
-		return make_intrusive<RecordVal>(zeek::BifType::Record::Supervisor::Status);
+		return zeek::make_intrusive<RecordVal>(zeek::BifType::Record::Supervisor::Status);
 		}
 
 	return zeek::supervisor_mgr->Status(node->CheckString());
@@ -35,11 +35,11 @@ function Supervisor::__create%(node: Supervisor::NodeConfig%): string
 	if ( ! zeek::supervisor_mgr )
 		{
 		builtin_error("supervisor mode not enabled");
-		return make_intrusive<StringVal>("supervisor mode not enabled");
+		return zeek::make_intrusive<StringVal>("supervisor mode not enabled");
 		}
 
 	auto rval = zeek::supervisor_mgr->Create(node->AsRecordVal());
-	return make_intrusive<StringVal>(rval);
+	return zeek::make_intrusive<StringVal>(rval);
 	%}
 
 function Supervisor::__destroy%(node: string%): bool
@@ -85,7 +85,7 @@ function Supervisor::__node%(%): Supervisor::NodeConfig
 		{
 		builtin_error("not a supervised process");
 		const auto& rt = zeek::BifType::Record::Supervisor::NodeConfig;
-		auto rval = make_intrusive<RecordVal>(rt);
+		auto rval = zeek::make_intrusive<RecordVal>(rt);
 		rval->Assign<StringVal>(rt->FieldOffset("name"), "<invalid>");
 		return rval;
 		}
diff --git a/src/threading/Manager.cc b/src/threading/Manager.cc
index 58d6c30dea..31bc6d57d7 100644
--- a/src/threading/Manager.cc
+++ b/src/threading/Manager.cc
@@ -165,7 +165,7 @@ bool Manager::SendEvent(MsgThread* thread, const std::string& name, const int nu
 	for ( int j = 0; j < num_vals; j++)
 		{
 		Val* v = Value::ValueToVal(std::string("thread ") + thread->Name(), vals[j], convert_error);
-		vl.emplace_back(AdoptRef{}, v);
+		vl.emplace_back(zeek::AdoptRef{}, v);
 
 		if ( v && ! convert_error && ! same_type(type->GetFieldType(j), v->GetType()) )
 			{
diff --git a/src/threading/SerialTypes.cc b/src/threading/SerialTypes.cc
index c2a0610561..a46cb87e7b 100644
--- a/src/threading/SerialTypes.cc
+++ b/src/threading/SerialTypes.cc
@@ -524,10 +524,10 @@ Val* Value::ValueToVal(const std::string& source, const Value* val, bool& have_e
 
 		case zeek::TYPE_TABLE:
 			{
-			IntrusivePtr<zeek::TypeList> set_index;
+			zeek::IntrusivePtr<zeek::TypeList> set_index;
 			if ( val->val.set_val.size == 0 && val->subtype == zeek::TYPE_VOID )
 				// don't know type - unspecified table.
-				set_index = make_intrusive<zeek::TypeList>();
+				set_index = zeek::make_intrusive<zeek::TypeList>();
 			else
 				{
 				// all entries have to have the same type...
@@ -535,7 +535,7 @@ Val* Value::ValueToVal(const std::string& source, const Value* val, bool& have_e
 				if ( stag == zeek::TYPE_VOID )
 					stag = val->val.set_val.vals[0]->type;
 
-				IntrusivePtr<zeek::Type> index_type;
+				zeek::IntrusivePtr<zeek::Type> index_type;
 
 				if ( stag == zeek::TYPE_ENUM )
 					{
@@ -558,16 +558,16 @@ Val* Value::ValueToVal(const std::string& source, const Value* val, bool& have_e
 				else
 					index_type = zeek::base_type(stag);
 
-				set_index = make_intrusive<zeek::TypeList>(index_type);
+				set_index = zeek::make_intrusive<zeek::TypeList>(index_type);
 				set_index->Append(std::move(index_type));
 				}
 
-			auto s = make_intrusive<zeek::SetType>(std::move(set_index), nullptr);
+			auto s = zeek::make_intrusive<zeek::SetType>(std::move(set_index), nullptr);
 			TableVal* t = new TableVal(std::move(s));
 			for ( int j = 0; j < val->val.set_val.size; j++ )
 				{
 				Val* assignval = ValueToVal(source, val->val.set_val.vals[j], have_error);
-				t->Assign({AdoptRef{}, assignval}, nullptr);
+				t->Assign({zeek::AdoptRef{}, assignval}, nullptr);
 				}
 
 			return t;
@@ -575,7 +575,7 @@ Val* Value::ValueToVal(const std::string& source, const Value* val, bool& have_e
 
 		case zeek::TYPE_VECTOR:
 			{
-			IntrusivePtr<zeek::Type> type;
+			zeek::IntrusivePtr<zeek::Type> type;
 
 			if ( val->val.vector_val.size == 0  && val->subtype == zeek::TYPE_VOID )
 				// don't know type - unspecified table.
@@ -589,13 +589,13 @@ Val* Value::ValueToVal(const std::string& source, const Value* val, bool& have_e
 					type = zeek::base_type(val->subtype);
 				}
 
-			auto vt = make_intrusive<zeek::VectorType>(std::move(type));
-			auto v = make_intrusive<VectorVal>(std::move(vt));
+			auto vt = zeek::make_intrusive<zeek::VectorType>(std::move(type));
+			auto v = zeek::make_intrusive<VectorVal>(std::move(vt));
 
 			for ( int j = 0; j < val->val.vector_val.size; j++ )
 				{
 				auto el = ValueToVal(source, val->val.vector_val.vals[j], have_error);
-				v->Assign(j, {AdoptRef{}, el});
+				v->Assign(j, {zeek::AdoptRef{}, el});
 				}
 
 			return v.release();
diff --git a/src/zeek-setup.cc b/src/zeek-setup.cc
index 0563f5ef7d..91e2749c25 100644
--- a/src/zeek-setup.cc
+++ b/src/zeek-setup.cc
@@ -114,16 +114,16 @@ vector<string> params;
 set<string> requested_plugins;
 const char* proc_status_file = nullptr;
 
-IntrusivePtr<zeek::OpaqueType> md5_type;
-IntrusivePtr<zeek::OpaqueType> sha1_type;
-IntrusivePtr<zeek::OpaqueType> sha256_type;
-IntrusivePtr<zeek::OpaqueType> entropy_type;
-IntrusivePtr<zeek::OpaqueType> cardinality_type;
-IntrusivePtr<zeek::OpaqueType> topk_type;
-IntrusivePtr<zeek::OpaqueType> bloomfilter_type;
-IntrusivePtr<zeek::OpaqueType> x509_opaque_type;
-IntrusivePtr<zeek::OpaqueType> ocsp_resp_opaque_type;
-IntrusivePtr<zeek::OpaqueType> paraglob_type;
+zeek::IntrusivePtr<zeek::OpaqueType> md5_type;
+zeek::IntrusivePtr<zeek::OpaqueType> sha1_type;
+zeek::IntrusivePtr<zeek::OpaqueType> sha256_type;
+zeek::IntrusivePtr<zeek::OpaqueType> entropy_type;
+zeek::IntrusivePtr<zeek::OpaqueType> cardinality_type;
+zeek::IntrusivePtr<zeek::OpaqueType> topk_type;
+zeek::IntrusivePtr<zeek::OpaqueType> bloomfilter_type;
+zeek::IntrusivePtr<zeek::OpaqueType> x509_opaque_type;
+zeek::IntrusivePtr<zeek::OpaqueType> ocsp_resp_opaque_type;
+zeek::IntrusivePtr<zeek::OpaqueType> paraglob_type;
 
 // Keep copy of command line
 int bro_argc;
@@ -220,7 +220,7 @@ void done_with_network()
 		mgr.Drain();
 		// Don't propagate this event to remote clients.
 		mgr.Dispatch(new Event(net_done,
-		                       {make_intrusive<TimeVal>(timer_mgr->Time())}),
+		                       {zeek::make_intrusive<TimeVal>(timer_mgr->Time())}),
 		             true);
 		}
 
@@ -593,16 +593,16 @@ zeek::detail::SetupResult zeek::detail::setup(int argc, char** argv,
 
 	init_event_handlers();
 
-	md5_type = make_intrusive<zeek::OpaqueType>("md5");
-	sha1_type = make_intrusive<zeek::OpaqueType>("sha1");
-	sha256_type = make_intrusive<zeek::OpaqueType>("sha256");
-	entropy_type = make_intrusive<zeek::OpaqueType>("entropy");
-	cardinality_type = make_intrusive<zeek::OpaqueType>("cardinality");
-	topk_type = make_intrusive<zeek::OpaqueType>("topk");
-	bloomfilter_type = make_intrusive<zeek::OpaqueType>("bloomfilter");
-	x509_opaque_type = make_intrusive<zeek::OpaqueType>("x509");
-	ocsp_resp_opaque_type = make_intrusive<zeek::OpaqueType>("ocsp_resp");
-	paraglob_type = make_intrusive<zeek::OpaqueType>("paraglob");
+	md5_type = zeek::make_intrusive<zeek::OpaqueType>("md5");
+	sha1_type = zeek::make_intrusive<zeek::OpaqueType>("sha1");
+	sha256_type = zeek::make_intrusive<zeek::OpaqueType>("sha256");
+	entropy_type = zeek::make_intrusive<zeek::OpaqueType>("entropy");
+	cardinality_type = zeek::make_intrusive<zeek::OpaqueType>("cardinality");
+	topk_type = zeek::make_intrusive<zeek::OpaqueType>("topk");
+	bloomfilter_type = zeek::make_intrusive<zeek::OpaqueType>("bloomfilter");
+	x509_opaque_type = zeek::make_intrusive<zeek::OpaqueType>("x509");
+	ocsp_resp_opaque_type = zeek::make_intrusive<zeek::OpaqueType>("ocsp_resp");
+	paraglob_type = zeek::make_intrusive<zeek::OpaqueType>("paraglob");
 
 	// The leak-checker tends to produce some false
 	// positives (memory which had already been
@@ -689,7 +689,7 @@ zeek::detail::SetupResult zeek::detail::setup(int argc, char** argv,
 		if ( ! id )
 			reporter->InternalError("global cmd_line_bpf_filter not defined");
 
-		id->SetVal(make_intrusive<StringVal>(*options.pcap_filter));
+		id->SetVal(zeek::make_intrusive<StringVal>(*options.pcap_filter));
 		}
 
 	auto all_signature_files = options.signature_files;
@@ -843,7 +843,7 @@ zeek::detail::SetupResult zeek::detail::setup(int argc, char** argv,
 				continue;
 
 			mgr.Enqueue(zeek_script_loaded,
-				make_intrusive<StringVal>(i->name.c_str()),
+				zeek::make_intrusive<StringVal>(i->name.c_str()),
 				val_mgr->Count(i->include_level)
 			);
 			}
diff --git a/src/zeek.bif b/src/zeek.bif
index d63bf1453f..360a8defda 100644
--- a/src/zeek.bif
+++ b/src/zeek.bif
@@ -319,7 +319,7 @@ static int next_fmt(const char*& fmt, const zeek::Args* args, ODesc* d, int& n)
 ## .. zeek:see:: network_time
 function current_time%(%): time
 	%{
-	return make_intrusive<TimeVal>(current_time());
+	return zeek::make_intrusive<TimeVal>(current_time());
 	%}
 
 ## Returns the timestamp of the last packet processed. This function returns
@@ -331,7 +331,7 @@ function current_time%(%): time
 ## .. zeek:see:: current_time
 function network_time%(%): time
 	%{
-	return make_intrusive<TimeVal>(network_time);
+	return zeek::make_intrusive<TimeVal>(network_time);
 	%}
 
 ## Returns a system environment variable.
@@ -347,7 +347,7 @@ function getenv%(var: string%): string
 	const char* env_val = zeekenv(var->CheckString());
 	if ( ! env_val )
 		env_val = "";	// ###
-	return make_intrusive<StringVal>(env_val);
+	return zeek::make_intrusive<StringVal>(env_val);
 	%}
 
 ## Sets a system environment variable.
@@ -561,7 +561,7 @@ function md5_hash%(...%): string
 	%{
 	unsigned char digest[MD5_DIGEST_LENGTH];
 	MD5Val::digest(@ARG@, digest);
-	return make_intrusive<StringVal>(md5_digest_print(digest));
+	return zeek::make_intrusive<StringVal>(md5_digest_print(digest));
 	%}
 
 ## Computes the SHA1 hash value of the provided list of arguments.
@@ -581,7 +581,7 @@ function sha1_hash%(...%): string
 	%{
 	unsigned char digest[SHA_DIGEST_LENGTH];
 	SHA1Val::digest(@ARG@, digest);
-	return make_intrusive<StringVal>(sha1_digest_print(digest));
+	return zeek::make_intrusive<StringVal>(sha1_digest_print(digest));
 	%}
 
 ## Computes the SHA256 hash value of the provided list of arguments.
@@ -601,7 +601,7 @@ function sha256_hash%(...%): string
 	%{
 	unsigned char digest[SHA256_DIGEST_LENGTH];
 	SHA256Val::digest(@ARG@, digest);
-	return make_intrusive<StringVal>(sha256_digest_print(digest));
+	return zeek::make_intrusive<StringVal>(sha256_digest_print(digest));
 	%}
 
 ## Computes an HMAC-MD5 hash value of the provided list of arguments. The HMAC
@@ -617,7 +617,7 @@ function md5_hmac%(...%): string
 	%{
 	unsigned char hmac[MD5_DIGEST_LENGTH];
 	MD5Val::hmac(@ARG@, KeyedHash::shared_hmac_md5_key, hmac);
-	return make_intrusive<StringVal>(md5_digest_print(hmac));
+	return zeek::make_intrusive<StringVal>(md5_digest_print(hmac));
 	%}
 
 ## Constructs an MD5 handle to enable incremental hash computation. You can
@@ -640,7 +640,7 @@ function md5_hmac%(...%): string
 ##    sha256_hash sha256_hash_init sha256_hash_update sha256_hash_finish
 function md5_hash_init%(%): opaque of md5
 	%{
-	auto digest = make_intrusive<MD5Val>();
+	auto digest = zeek::make_intrusive<MD5Val>();
 	digest->Init();
 	return digest;
 	%}
@@ -665,7 +665,7 @@ function md5_hash_init%(%): opaque of md5
 ##    sha256_hash sha256_hash_init sha256_hash_update sha256_hash_finish
 function sha1_hash_init%(%): opaque of sha1
 	%{
-	auto digest = make_intrusive<SHA1Val>();
+	auto digest = zeek::make_intrusive<SHA1Val>();
 	digest->Init();
 	return digest;
 	%}
@@ -690,7 +690,7 @@ function sha1_hash_init%(%): opaque of sha1
 ##    sha256_hash sha256_hash_update sha256_hash_finish
 function sha256_hash_init%(%): opaque of sha256
 	%{
-	auto digest = make_intrusive<SHA256Val>();
+	auto digest = zeek::make_intrusive<SHA256Val>();
 	digest->Init();
 	return digest;
 	%}
@@ -822,7 +822,7 @@ function paraglob_init%(v: any%) : opaque of paraglob
 	try
 		{
 		std::unique_ptr<paraglob::Paraglob> p (new paraglob::Paraglob(patterns));
-		return make_intrusive<ParaglobVal>(std::move(p));
+		return zeek::make_intrusive<ParaglobVal>(std::move(p));
 		}
 	// Thrown if paraglob fails to add a pattern.
 	catch (const paraglob::add_error& e)
@@ -983,9 +983,9 @@ function identify_data%(data: string, return_mime: bool &default=T%): string
 	string strongest_match = file_mgr->DetectMIME(data->Bytes(), data->Len());
 
 	if ( strongest_match.empty() )
-		return make_intrusive<StringVal>("<unknown>");
+		return zeek::make_intrusive<StringVal>("<unknown>");
 
-	return make_intrusive<StringVal>(strongest_match);
+	return zeek::make_intrusive<StringVal>(strongest_match);
 	%}
 
 ## Determines the MIME type of a piece of data using Zeek's file magic
@@ -1052,12 +1052,12 @@ function find_entropy%(data: string%): entropy_test_result
 	e.Get(&ent, &chisq, &mean, &montepi, &scc);
 
 	static auto entropy_test_result = zeek::id::find_type<zeek::RecordType>("entropy_test_result");
-	auto ent_result = make_intrusive<RecordVal>(entropy_test_result);
-	ent_result->Assign(0, make_intrusive<DoubleVal>(ent));
-	ent_result->Assign(1, make_intrusive<DoubleVal>(chisq));
-	ent_result->Assign(2, make_intrusive<DoubleVal>(mean));
-	ent_result->Assign(3, make_intrusive<DoubleVal>(montepi));
-	ent_result->Assign(4, make_intrusive<DoubleVal>(scc));
+	auto ent_result = zeek::make_intrusive<RecordVal>(entropy_test_result);
+	ent_result->Assign(0, zeek::make_intrusive<DoubleVal>(ent));
+	ent_result->Assign(1, zeek::make_intrusive<DoubleVal>(chisq));
+	ent_result->Assign(2, zeek::make_intrusive<DoubleVal>(mean));
+	ent_result->Assign(3, zeek::make_intrusive<DoubleVal>(montepi));
+	ent_result->Assign(4, zeek::make_intrusive<DoubleVal>(scc));
 	return ent_result;
 	%}
 
@@ -1068,7 +1068,7 @@ function find_entropy%(data: string%): entropy_test_result
 ## .. zeek:see:: find_entropy entropy_test_add entropy_test_finish
 function entropy_test_init%(%): opaque of entropy
 	%{
-	return make_intrusive<EntropyVal>();
+	return zeek::make_intrusive<EntropyVal>();
 	%}
 
 ## Adds data to an incremental entropy calculation.
@@ -1104,12 +1104,12 @@ function entropy_test_finish%(handle: opaque of entropy%): entropy_test_result
 	static_cast<EntropyVal*>(handle)->Get(&ent, &chisq, &mean, &montepi, &scc);
 
 	static auto entropy_test_result = zeek::id::find_type<zeek::RecordType>("entropy_test_result");
-	auto ent_result = make_intrusive<RecordVal>(entropy_test_result);
-	ent_result->Assign(0, make_intrusive<DoubleVal>(ent));
-	ent_result->Assign(1, make_intrusive<DoubleVal>(chisq));
-	ent_result->Assign(2, make_intrusive<DoubleVal>(mean));
-	ent_result->Assign(3, make_intrusive<DoubleVal>(montepi));
-	ent_result->Assign(4, make_intrusive<DoubleVal>(scc));
+	auto ent_result = zeek::make_intrusive<RecordVal>(entropy_test_result);
+	ent_result->Assign(0, zeek::make_intrusive<DoubleVal>(ent));
+	ent_result->Assign(1, zeek::make_intrusive<DoubleVal>(chisq));
+	ent_result->Assign(2, zeek::make_intrusive<DoubleVal>(mean));
+	ent_result->Assign(3, zeek::make_intrusive<DoubleVal>(montepi));
+	ent_result->Assign(4, zeek::make_intrusive<DoubleVal>(scc));
 	return ent_result;
 	%}
 
@@ -1124,7 +1124,7 @@ function unique_id%(prefix: string%) : string
 	%{
 	char tmp[20];
 	uint64_t uid = calculate_unique_id(UID_POOL_DEFAULT_SCRIPT);
-	return make_intrusive<StringVal>(uitoa_n(uid, tmp, sizeof(tmp), 62, prefix->CheckString()));
+	return zeek::make_intrusive<StringVal>(uitoa_n(uid, tmp, sizeof(tmp), 62, prefix->CheckString()));
 	%}
 
 ## Creates an identifier that is unique with high probability.
@@ -1142,7 +1142,7 @@ function unique_id_from%(pool: int, prefix: string%) : string
 
 	char tmp[20];
 	uint64_t uid = calculate_unique_id(pool);
-	return make_intrusive<StringVal>(uitoa_n(uid, tmp, sizeof(tmp), 62, prefix->CheckString()));
+	return zeek::make_intrusive<StringVal>(uitoa_n(uid, tmp, sizeof(tmp), 62, prefix->CheckString()));
 	%}
 
 # ===========================================================================
@@ -1328,9 +1328,9 @@ function all_set%(v: any%) : bool
 
 %%{
 static Func* sort_function_comp = nullptr;
-static std::vector<const IntrusivePtr<Val>*> index_map;	// used for indirect sorting to support order()
+static std::vector<const zeek::IntrusivePtr<Val>*> index_map;	// used for indirect sorting to support order()
 
-bool sort_function(const IntrusivePtr<Val>& a, const IntrusivePtr<Val>& b)
+bool sort_function(const zeek::IntrusivePtr<Val>& a, const zeek::IntrusivePtr<Val>& b)
 	{
 	// Sort missing values as "high".
 	if ( ! a )
@@ -1349,7 +1349,7 @@ bool indirect_sort_function(size_t a, size_t b)
 	return sort_function(*index_map[a], *index_map[b]);
 	}
 
-bool signed_sort_function (const IntrusivePtr<Val>& a, const IntrusivePtr<Val>& b)
+bool signed_sort_function (const zeek::IntrusivePtr<Val>& a, const zeek::IntrusivePtr<Val>& b)
 	{
 	if ( ! a )
 		return 0;
@@ -1362,7 +1362,7 @@ bool signed_sort_function (const IntrusivePtr<Val>& a, const IntrusivePtr<Val>&
 	return ia < ib;
 	}
 
-bool unsigned_sort_function (const IntrusivePtr<Val>& a, const IntrusivePtr<Val>& b)
+bool unsigned_sort_function (const zeek::IntrusivePtr<Val>& a, const zeek::IntrusivePtr<Val>& b)
 	{
 	if ( ! a )
 		return 0;
@@ -1401,7 +1401,7 @@ bool indirect_unsigned_sort_function(size_t a, size_t b)
 ## .. zeek:see:: order
 function sort%(v: any, ...%) : any
 	%{
-	IntrusivePtr<Val> rval{NewRef{}, v};
+	zeek::IntrusivePtr<Val> rval{zeek::NewRef{}, v};
 
 	if ( v->GetType()->Tag() != zeek::TYPE_VECTOR )
 		{
@@ -1471,7 +1471,7 @@ function sort%(v: any, ...%) : any
 ## .. zeek:see:: sort
 function order%(v: any, ...%) : index_vec
 	%{
-	auto result_v = make_intrusive<VectorVal>(zeek::id::index_vec);
+	auto result_v = zeek::make_intrusive<VectorVal>(zeek::id::index_vec);
 
 	if ( v->GetType()->Tag() != zeek::TYPE_VECTOR )
 		{
@@ -1491,7 +1491,7 @@ function order%(v: any, ...%) : index_vec
 		if ( ! IsFunc(comp_val->GetType()->Tag()) )
 			{
 			builtin_error("second argument to order() needs to be comparison function");
-			return IntrusivePtr<Val>{NewRef{}, v};
+			return zeek::IntrusivePtr<Val>{zeek::NewRef{}, v};
 			}
 
 		comp = comp_val->AsFunc();
@@ -1521,7 +1521,7 @@ function order%(v: any, ...%) : index_vec
 		     ! comp_type->ParamList()->AllMatch(elt_type, 0) )
 			{
 			builtin_error("invalid comparison function in call to order()");
-			return IntrusivePtr<Val>{NewRef{}, v};
+			return zeek::IntrusivePtr<Val>{zeek::NewRef{}, v};
 			}
 
 		sort_function_comp = comp;
@@ -1570,7 +1570,7 @@ function cat%(...%): string
 	BroString* s = new BroString(1, d.TakeBytes(), d.Len());
 	s->SetUseFreeToDelete(true);
 
-	return make_intrusive<StringVal>(s);
+	return zeek::make_intrusive<StringVal>(s);
 	%}
 
 ## Concatenates all arguments, with a separator placed between each one. This
@@ -1612,7 +1612,7 @@ function cat_sep%(sep: string, def: string, ...%): string
 	BroString* s = new BroString(1, d.TakeBytes(), d.Len());
 	s->SetUseFreeToDelete(true);
 
-	return make_intrusive<StringVal>(s);
+	return zeek::make_intrusive<StringVal>(s);
 	%}
 
 ## Produces a formatted string à la ``printf``. The first argument is the
@@ -1687,7 +1687,7 @@ function fmt%(...%): string
 	BroString* s = new BroString(1, d.TakeBytes(), d.Len());
 	s->SetUseFreeToDelete(true);
 
-	return make_intrusive<StringVal>(s);
+	return zeek::make_intrusive<StringVal>(s);
 	%}
 
 ## Renders a sequence of values to a string of bytes and outputs them directly
@@ -1723,7 +1723,7 @@ function print_raw%(...%): bool
 ## .. zeek:see:: sqrt exp ln log10
 function floor%(d: double%): double
 	%{
-	return make_intrusive<DoubleVal>(floor(d));
+	return zeek::make_intrusive<DoubleVal>(floor(d));
 	%}
 
 ## Computes the square root of a :zeek:type:`double`.
@@ -1738,10 +1738,10 @@ function sqrt%(x: double%): double
 	if ( x < 0 )
 		{
 		reporter->Error("negative sqrt argument");
-		return make_intrusive<DoubleVal>(-1.0);
+		return zeek::make_intrusive<DoubleVal>(-1.0);
 		}
 
-	return make_intrusive<DoubleVal>(sqrt(x));
+	return zeek::make_intrusive<DoubleVal>(sqrt(x));
 	%}
 
 ## Computes the exponential function.
@@ -1753,7 +1753,7 @@ function sqrt%(x: double%): double
 ## .. zeek:see:: floor sqrt ln log10
 function exp%(d: double%): double
 	%{
-	return make_intrusive<DoubleVal>(exp(d));
+	return zeek::make_intrusive<DoubleVal>(exp(d));
 	%}
 
 ## Computes the natural logarithm of a number.
@@ -1765,7 +1765,7 @@ function exp%(d: double%): double
 ## .. zeek:see:: exp floor sqrt log10
 function ln%(d: double%): double
 	%{
-	return make_intrusive<DoubleVal>(log(d));
+	return zeek::make_intrusive<DoubleVal>(log(d));
 	%}
 
 ## Computes the common logarithm of a number.
@@ -1777,7 +1777,7 @@ function ln%(d: double%): double
 ## .. zeek:see:: exp floor sqrt ln
 function log10%(d: double%): double
 	%{
-	return make_intrusive<DoubleVal>(log10(d));
+	return zeek::make_intrusive<DoubleVal>(log10(d));
 	%}
 
 # ===========================================================================
@@ -1812,7 +1812,7 @@ extern const char* zeek_version();
 ## Returns: Zeek's version, e.g., 2.0-beta-47-debug.
 function zeek_version%(%): string
 	%{
-	return make_intrusive<StringVal>(zeek_version());
+	return zeek::make_intrusive<StringVal>(zeek_version());
 	%}
 
 ## Converts a record type name to a vector of strings, where each element is
@@ -1823,12 +1823,12 @@ function zeek_version%(%): string
 ## Returns: A string vector with the field names of *rt*.
 function record_type_to_vector%(rt: string%): string_vec
 	%{
-	auto result = make_intrusive<VectorVal>(zeek::id::string_vec);
+	auto result = zeek::make_intrusive<VectorVal>(zeek::id::string_vec);
 
 	zeek::RecordType* type = zeek::id::find_type(rt->CheckString())->AsRecordType();
 
 	for ( int i = 0; i < type->NumFields(); ++i )
-		result->Assign(i+1, make_intrusive<StringVal>(type->FieldName(i)));
+		result->Assign(i+1, zeek::make_intrusive<StringVal>(type->FieldName(i)));
 
 	return result;
 	%}
@@ -1846,17 +1846,17 @@ function type_name%(t: any%): string
 	BroString* s = new BroString(1, d.TakeBytes(), d.Len());
 	s->SetUseFreeToDelete(true);
 
-	return make_intrusive<StringVal>(s);
+	return zeek::make_intrusive<StringVal>(s);
 	%}
 
 ## Returns: list of command-line arguments (``argv``) used to run Zeek.
 function zeek_args%(%): string_vec
 	%{
 	auto sv = zeek::id::string_vec;
-	auto rval = make_intrusive<VectorVal>(std::move(sv));
+	auto rval = zeek::make_intrusive<VectorVal>(std::move(sv));
 
 	for ( auto i = 0; i < bro_argc; ++i )
-		rval->Assign(rval->Size(), make_intrusive<StringVal>(bro_argv[i]));
+		rval->Assign(rval->Size(), zeek::make_intrusive<StringVal>(bro_argv[i]));
 
 	return rval;
 	%}
@@ -1892,12 +1892,12 @@ function packet_source%(%): PacketSource
 	%{
 	static auto ps_type = zeek::id::find_type<zeek::RecordType>("PacketSource");
 	auto ps = iosource_mgr->GetPktSrc();
-	auto r = make_intrusive<RecordVal>(ps_type);
+	auto r = zeek::make_intrusive<RecordVal>(ps_type);
 
 	if ( ps )
 		{
 		r->Assign(0, val_mgr->Bool(ps->IsLive()));
-		r->Assign(1, make_intrusive<StringVal>(ps->Path()));
+		r->Assign(1, zeek::make_intrusive<StringVal>(ps->Path()));
 		r->Assign(2, val_mgr->Int(ps->LinkType()));
 		r->Assign(3, val_mgr->Count(ps->Netmask()));
 		}
@@ -1913,7 +1913,7 @@ function packet_source%(%): PacketSource
 ## .. zeek:see:: global_ids
 function global_sizes%(%): var_sizes
 	%{
-	auto sizes = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, var_sizes});
+	auto sizes = zeek::make_intrusive<TableVal>(IntrusivePtr{zeek::NewRef{}, var_sizes});
 	const auto& globals = global_scope()->Vars();
 
 	for ( const auto& global : globals )
@@ -1921,7 +1921,7 @@ function global_sizes%(%): var_sizes
 		auto& id = global.second;
 		if ( id->HasVal() )
 			{
-			auto id_name = make_intrusive<StringVal>(id->Name());
+			auto id_name = zeek::make_intrusive<StringVal>(id->Name());
 			auto id_size = val_mgr->Count(id->GetVal()->MemoryAllocation());
 			sizes->Assign(std::move(id_name), std::move(id_size));
 			}
@@ -1941,15 +1941,15 @@ function global_sizes%(%): var_sizes
 function global_ids%(%): id_table
 	%{
 	static auto id_table = zeek::id::find_type<zeek::TableType>("id_table");
-	auto ids = make_intrusive<TableVal>(id_table);
+	auto ids = zeek::make_intrusive<TableVal>(id_table);
 	const auto& globals = global_scope()->Vars();
 
 	for ( const auto& global : globals )
 		{
 		const auto& id = global.second;
 		static auto script_id = zeek::id::find_type<zeek::RecordType>("script_id");
-		auto rec = make_intrusive<RecordVal>(script_id);
-		rec->Assign(0, make_intrusive<StringVal>(type_name(id->GetType()->Tag())));
+		auto rec = zeek::make_intrusive<RecordVal>(script_id);
+		rec->Assign(0, zeek::make_intrusive<StringVal>(type_name(id->GetType()->Tag())));
 		rec->Assign(1, val_mgr->Bool(id->IsExport()));
 		rec->Assign(2, val_mgr->Bool(id->IsConst()));
 		rec->Assign(3, val_mgr->Bool(id->IsEnumConst()));
@@ -1959,7 +1959,7 @@ function global_ids%(%): id_table
 		if ( id->HasVal() )
 			rec->Assign(6, id->GetVal());
 
-		auto id_name = make_intrusive<StringVal>(id->Name());
+		auto id_name = zeek::make_intrusive<StringVal>(id->Name());
 		ids->Assign(std::move(id_name), std::move(rec));
 		}
 
@@ -1976,10 +1976,10 @@ function lookup_ID%(id: string%) : any
 	%{
 	const auto& i = global_scope()->Find(id->CheckString());
 	if ( ! i )
-		return make_intrusive<StringVal>("<unknown id>");
+		return zeek::make_intrusive<StringVal>("<unknown id>");
 
 	if ( ! i->GetVal() )
-		return make_intrusive<StringVal>("<no ID value>");
+		return zeek::make_intrusive<StringVal>("<no ID value>");
 
 	return i->GetVal();
 	%}
@@ -2002,7 +2002,7 @@ function record_fields%(rec: any%): record_field_table
 		if ( ! id || ! id->IsType() || id->GetType()->Tag() != zeek::TYPE_RECORD )
 			{
 			reporter->Error("record_fields string argument does not name a record type");
-			return make_intrusive<TableVal>(record_field_table);
+			return zeek::make_intrusive<TableVal>(record_field_table);
 			}
 
 		return id->GetType()->AsRecordType()->GetRecordFieldsVal();
@@ -2117,7 +2117,7 @@ function gethostname%(%) : string
 		strcpy(buffer, "<unknown>");
 
 	buffer[MAXHOSTNAMELEN-1] = '\0';
-	return make_intrusive<StringVal>(buffer);
+	return zeek::make_intrusive<StringVal>(buffer);
 	%}
 
 ## Returns whether an address is IPv4 or not.
@@ -2188,7 +2188,7 @@ function is_v6_subnet%(s: subnet%): bool
 ## Returns: The vector of addresses contained in the routing header data.
 function routing0_data_to_addrs%(s: string%): addr_vec
 	%{
-	auto rval = make_intrusive<VectorVal>(zeek::id::find_type<zeek::VectorType>("addr_vec"));
+	auto rval = zeek::make_intrusive<VectorVal>(zeek::id::find_type<zeek::VectorType>("addr_vec"));
 
 	int len = s->Len();
 	const u_char* bytes = s->Bytes();
@@ -2201,7 +2201,7 @@ function routing0_data_to_addrs%(s: string%): addr_vec
 	while ( len > 0 )
 		{
 		IPAddr a(IPv6, (const uint32_t*) bytes, IPAddr::Network);
-		rval->Assign(rval->Size(), make_intrusive<AddrVal>(a));
+		rval->Assign(rval->Size(), zeek::make_intrusive<AddrVal>(a));
 		bytes += 16;
 		len -= 16;
 		}
@@ -2219,7 +2219,7 @@ function routing0_data_to_addrs%(s: string%): addr_vec
 ## .. zeek:see:: counts_to_addr
 function addr_to_counts%(a: addr%): index_vec
 	%{
-	auto rval = make_intrusive<VectorVal>(zeek::id::index_vec);
+	auto rval = zeek::make_intrusive<VectorVal>(zeek::id::index_vec);
 	const uint32_t* bytes;
 	int len = a->AsAddr().GetBytes(&bytes);
 
@@ -2241,21 +2241,21 @@ function counts_to_addr%(v: index_vec%): addr
 	%{
 	if ( v->AsVector()->size() == 1 )
 		{
-		return make_intrusive<AddrVal>(htonl((*v->AsVector())[0]->AsCount()));
+		return zeek::make_intrusive<AddrVal>(htonl((*v->AsVector())[0]->AsCount()));
 		}
 	else if ( v->AsVector()->size() == 4 )
 		{
 		uint32_t bytes[4];
 		for ( int i = 0; i < 4; ++i )
 			bytes[i] = htonl((*v->AsVector())[i]->AsCount());
-		return make_intrusive<AddrVal>(bytes);
+		return zeek::make_intrusive<AddrVal>(bytes);
 		}
 	else
 		{
 		builtin_error("invalid vector size", @ARG@[0]);
 		uint32_t bytes[4];
 		memset(bytes, 0, sizeof(bytes));
-		return make_intrusive<AddrVal>(bytes);
+		return zeek::make_intrusive<AddrVal>(bytes);
 		}
 	%}
 
@@ -2363,7 +2363,7 @@ function to_count%(str: string%): count
 ## .. zeek:see:: double_to_interval
 function interval_to_double%(i: interval%): double
 	%{
-	return make_intrusive<DoubleVal>(i);
+	return zeek::make_intrusive<DoubleVal>(i);
 	%}
 
 ## Converts a :zeek:type:`time` value to a :zeek:type:`double`.
@@ -2375,7 +2375,7 @@ function interval_to_double%(i: interval%): double
 ## .. zeek:see:: double_to_time
 function time_to_double%(t: time%): double
 	%{
-	return make_intrusive<DoubleVal>(t);
+	return zeek::make_intrusive<DoubleVal>(t);
 	%}
 
 ## Converts a :zeek:type:`double` value to a :zeek:type:`time`.
@@ -2387,7 +2387,7 @@ function time_to_double%(t: time%): double
 ## .. zeek:see:: time_to_double double_to_count
 function double_to_time%(d: double%): time
 	%{
-	return make_intrusive<TimeVal>(d);
+	return zeek::make_intrusive<TimeVal>(d);
 	%}
 
 ## Converts a :zeek:type:`double` to an :zeek:type:`interval`.
@@ -2399,7 +2399,7 @@ function double_to_time%(d: double%): time
 ## .. zeek:see:: interval_to_double
 function double_to_interval%(d: double%): interval
 	%{
-	return make_intrusive<IntervalVal>(d);
+	return zeek::make_intrusive<IntervalVal>(d);
 	%}
 
 ## Converts a :zeek:type:`port` to a :zeek:type:`count`.
@@ -2440,14 +2440,14 @@ function count_to_port%(num: count, proto: transport_proto%): port
 function to_addr%(ip: string%): addr
 	%{
 	char* s = ip->AsString()->Render();
-	IntrusivePtr<Val> ret;
+	zeek::IntrusivePtr<Val> ret;
 	in6_addr tmp;
 
 	if ( IPAddr::ConvertString(s, &tmp) )
-		ret = make_intrusive<AddrVal>(IPAddr(tmp));
+		ret = zeek::make_intrusive<AddrVal>(IPAddr(tmp));
 	else
 		{
-		ret = make_intrusive<AddrVal>(IPAddr());
+		ret = zeek::make_intrusive<AddrVal>(IPAddr());
 		builtin_error("failed converting string to IP address", ip);
 		}
 
@@ -2485,7 +2485,7 @@ function to_subnet%(sn: string%): subnet
 	if ( ! IPPrefix::ConvertString(s, &tmp) )
 		builtin_error("failed converting string to IP prefix", sn);
 
-	auto ret = make_intrusive<SubNetVal>(tmp);
+	auto ret = zeek::make_intrusive<SubNetVal>(tmp);
 	delete [] s;
 	return ret;
 	%}
@@ -2500,7 +2500,7 @@ function to_subnet%(sn: string%): subnet
 function addr_to_subnet%(a: addr%): subnet
 	%{
 	int width = (a->AsAddr().GetFamily() == IPv4 ? 32 : 128);
-	return make_intrusive<SubNetVal>(a->AsAddr(), width);
+	return zeek::make_intrusive<SubNetVal>(a->AsAddr(), width);
 	%}
 
 ## Converts a :zeek:type:`subnet` to an :zeek:type:`addr` by
@@ -2513,7 +2513,7 @@ function addr_to_subnet%(a: addr%): subnet
 ## .. zeek:see:: to_subnet
 function subnet_to_addr%(sn: subnet%): addr
 	%{
-	return make_intrusive<AddrVal>(sn->Prefix());
+	return zeek::make_intrusive<AddrVal>(sn->Prefix());
 	%}
 
 ## Returns the width of a :zeek:type:`subnet`.
@@ -2548,7 +2548,7 @@ function to_double%(str: string%): double
 		d = 0;
 		}
 
-	return make_intrusive<DoubleVal>(d);
+	return zeek::make_intrusive<DoubleVal>(d);
 	%}
 
 ## Converts a :zeek:type:`count` to an :zeek:type:`addr`.
@@ -2563,10 +2563,10 @@ function count_to_v4_addr%(ip: count%): addr
 	if ( ip > 4294967295LU )
 		{
 		builtin_error("conversion of non-IPv4 count to addr", @ARG@[0]);
-		return make_intrusive<AddrVal>(uint32_t(0));
+		return zeek::make_intrusive<AddrVal>(uint32_t(0));
 		}
 
-	return make_intrusive<AddrVal>(htonl(uint32_t(ip)));
+	return zeek::make_intrusive<AddrVal>(htonl(uint32_t(ip)));
 	%}
 
 ## Converts a :zeek:type:`string` of bytes into an IPv4 address. In particular,
@@ -2591,7 +2591,7 @@ function raw_bytes_to_v4_addr%(b: string%): addr
 		a = (bp[0] << 24) | (bp[1] << 16) | (bp[2] << 8) | bp[3];
 		}
 
-	return make_intrusive<AddrVal>(htonl(a));
+	return zeek::make_intrusive<AddrVal>(htonl(a));
 	%}
 
 ## Converts a :zeek:type:`string` to a :zeek:type:`port`.
@@ -2637,13 +2637,13 @@ function bytestring_to_double%(s: string%): double
 	if ( s->Len() != sizeof(double) )
 		{
 		builtin_error("bad conversion to double");
-		return make_intrusive<DoubleVal>(0.0);
+		return zeek::make_intrusive<DoubleVal>(0.0);
 		}
 
 	// See #908 for a discussion of portability.
 	double d;
 	memcpy(&d, s->Bytes(), sizeof(double));
-	return make_intrusive<DoubleVal>(ntohd(d));
+	return zeek::make_intrusive<DoubleVal>(ntohd(d));
 	%}
 
 ## Converts a string of bytes to a :zeek:type:`count`.
@@ -2764,7 +2764,7 @@ function ptr_name_to_addr%(s: string%): addr
 		else
 			addr = (a[3] << 24) | (a[2] << 16) | (a[1] << 8) | a[0];
 
-		return make_intrusive<AddrVal>(htonl(addr));
+		return zeek::make_intrusive<AddrVal>(htonl(addr));
 		}
 	else
 		{
@@ -2797,7 +2797,7 @@ function ptr_name_to_addr%(s: string%): addr
 				}
 			}
 
-		return make_intrusive<AddrVal>(addr6);
+		return zeek::make_intrusive<AddrVal>(addr6);
 		}
 	%}
 
@@ -2811,7 +2811,7 @@ function ptr_name_to_addr%(s: string%): addr
 ## .. zeek:see:: ptr_name_to_addr to_addr
 function addr_to_ptr_name%(a: addr%): string
 	%{
-	return make_intrusive<StringVal>(a->AsAddr().PtrName().c_str());
+	return zeek::make_intrusive<StringVal>(a->AsAddr().PtrName().c_str());
 	%}
 
 ## Converts a string of bytes into its hexadecimal representation.
@@ -2833,7 +2833,7 @@ function bytestring_to_hexstr%(bytestring: string%): string
 	for ( bro_uint_t i = 0; i < len; ++i )
 		snprintf(hexstr + (2 * i), 3, "%.2hhx", bytes[i]);
 
-	return make_intrusive<StringVal>(hexstr);
+	return zeek::make_intrusive<StringVal>(hexstr);
 	%}
 
 ## Converts a hex-string into its binary representation.
@@ -2880,7 +2880,7 @@ function hexstr_to_bytestring%(hexstr: string%): string
 
 		}
 
-	return make_intrusive<StringVal>(outlen, bytestring);
+	return zeek::make_intrusive<StringVal>(outlen, bytestring);
 	%}
 
 ## Encodes a Base64-encoded string.
@@ -2897,7 +2897,7 @@ function encode_base64%(s: string, a: string &default=""%): string
 	%{
 	BroString* t = encode_base64(s->AsString(), a->AsString());
 	if ( t )
-		return make_intrusive<StringVal>(t);
+		return zeek::make_intrusive<StringVal>(t);
 	else
 		{
 		reporter->Error("Broker query has an invalid data store");
@@ -2919,7 +2919,7 @@ function decode_base64%(s: string, a: string &default=""%): string
 	%{
 	BroString* t = decode_base64(s->AsString(), a->AsString());
 	if ( t )
-		return make_intrusive<StringVal>(t);
+		return zeek::make_intrusive<StringVal>(t);
 	else
 		{
 		reporter->Error("error in decoding string %s", s->CheckString());
@@ -2952,7 +2952,7 @@ function decode_base64_conn%(cid: conn_id, s: string, a: string &default=""%): s
 
 	BroString* t = decode_base64(s->AsString(), a->AsString(), conn);
 	if ( t )
-		return make_intrusive<StringVal>(t);
+		return zeek::make_intrusive<StringVal>(t);
 	else
 		{
 		reporter->Error("error in decoding string %s", s->CheckString());
@@ -2982,7 +2982,7 @@ typedef struct {
 function uuid_to_string%(uuid: string%): string
 	%{
 	if ( uuid->Len() != 16 )
-		return make_intrusive<StringVal>("<Invalid UUID>");
+		return zeek::make_intrusive<StringVal>("<Invalid UUID>");
 
 	bro_uuid_t* id = (bro_uuid_t*) uuid->Bytes();
 
@@ -3000,7 +3000,7 @@ function uuid_to_string%(uuid: string%): string
 		id->node[4],
 		id->node[5]);
 
-	return make_intrusive<StringVal>(s);
+	return zeek::make_intrusive<StringVal>(s);
 	%}
 
 %%{
@@ -3040,7 +3040,7 @@ char* to_pat_str(int sn, const char* ss)
 function convert_for_pattern%(s: string%): string
 	%{
 	char* t = to_pat_str(s->Len(), (const char*)(s->Bytes()));
-	auto ret = make_intrusive<StringVal>(t);
+	auto ret = zeek::make_intrusive<StringVal>(t);
 	delete [] t;
 	return ret;
 	%}
@@ -3074,7 +3074,7 @@ function string_to_pattern%(s: string, convert: bool%): pattern
 	RE_Matcher* re = new RE_Matcher(pat);
 	delete [] pat;
 	re->Compile();
-	return make_intrusive<PatternVal>(re);
+	return zeek::make_intrusive<PatternVal>(re);
 	%}
 
 ## Formats a given time value according to a format string.
@@ -3093,9 +3093,9 @@ function strftime%(fmt: string, d: time%) : string
 
 	if ( ! localtime_r(&timeval, &t) ||
 	     ! strftime(buffer, 128, fmt->CheckString(), &t) )
-		return make_intrusive<StringVal>("<strftime error>");
+		return zeek::make_intrusive<StringVal>("<strftime error>");
 
-	return make_intrusive<StringVal>(buffer);
+	return zeek::make_intrusive<StringVal>(buffer);
 	%}
 
 
@@ -3116,11 +3116,11 @@ function strptime%(fmt: string, d: string%) : time
 	     ! strptime(d->CheckString(), fmt->CheckString(), &t) )
 		{
 		reporter->Warning("strptime conversion failed: fmt:%s d:%s", fmt->CheckString(), d->CheckString());
-		return make_intrusive<TimeVal>(0.0);
+		return zeek::make_intrusive<TimeVal>(0.0);
 		}
 
 	double ret = mktime(&t);
-	return make_intrusive<TimeVal>(ret);
+	return zeek::make_intrusive<TimeVal>(ret);
 	%}
 
 
@@ -3143,7 +3143,7 @@ function strptime%(fmt: string, d: string%) : time
 ## .. zeek:see:: remask_addr
 function mask_addr%(a: addr, top_bits_to_keep: count%): subnet
 	%{
-	return make_intrusive<SubNetVal>(a->AsAddr(), top_bits_to_keep);
+	return zeek::make_intrusive<SubNetVal>(a->AsAddr(), top_bits_to_keep);
 	%}
 
 ## Takes some top bits (such as a subnet address) from one address and the other
@@ -3169,7 +3169,7 @@ function remask_addr%(a1: addr, a2: addr, top_bits_from_a1: count%): addr
 	addr1.Mask(top_bits_from_a1);
 	IPAddr addr2(a2->AsAddr());
 	addr2.ReverseMask(top_bits_from_a1);
-	return make_intrusive<AddrVal>(addr1|addr2);
+	return zeek::make_intrusive<AddrVal>(addr1|addr2);
 	%}
 
 ## Checks whether a given :zeek:type:`port` has TCP as transport protocol.
@@ -3209,7 +3209,7 @@ function is_icmp_port%(p: port%): bool
 	%}
 
 %%{
-static IntrusivePtr<EnumVal> map_conn_type(TransportProto tp)
+static zeek::IntrusivePtr<EnumVal> map_conn_type(TransportProto tp)
 	{
 	switch ( tp ) {
 	case TRANSPORT_UNKNOWN:
@@ -3300,29 +3300,29 @@ function lookup_connection%(cid: conn_id%): connection
 	builtin_error("connection ID not a known connection", cid);
 
 	// Return a dummy connection record.
-	auto c = make_intrusive<RecordVal>(zeek::id::connection);
+	auto c = zeek::make_intrusive<RecordVal>(zeek::id::connection);
 
-	auto id_val = make_intrusive<RecordVal>(zeek::id::conn_id);
-	id_val->Assign(0, make_intrusive<AddrVal>((unsigned int) 0));
+	auto id_val = zeek::make_intrusive<RecordVal>(zeek::id::conn_id);
+	id_val->Assign(0, zeek::make_intrusive<AddrVal>((unsigned int) 0));
 	id_val->Assign(1, val_mgr->Port(ntohs(0), TRANSPORT_UDP));
-	id_val->Assign(2, make_intrusive<AddrVal>((unsigned int) 0));
+	id_val->Assign(2, zeek::make_intrusive<AddrVal>((unsigned int) 0));
 	id_val->Assign(3, val_mgr->Port(ntohs(0), TRANSPORT_UDP));
 	c->Assign(0, std::move(id_val));
 
-	auto orig_endp = make_intrusive<RecordVal>(zeek::id::endpoint);
+	auto orig_endp = zeek::make_intrusive<RecordVal>(zeek::id::endpoint);
 	orig_endp->Assign(0, val_mgr->Count(0));
 	orig_endp->Assign(1, val_mgr->Count(int(0)));
 
-	auto resp_endp = make_intrusive<RecordVal>(zeek::id::endpoint);
+	auto resp_endp = zeek::make_intrusive<RecordVal>(zeek::id::endpoint);
 	resp_endp->Assign(0, val_mgr->Count(0));
 	resp_endp->Assign(1, val_mgr->Count(int(0)));
 
 	c->Assign(1, std::move(orig_endp));
 	c->Assign(2, std::move(resp_endp));
 
-	c->Assign(3, make_intrusive<TimeVal>(network_time));
-	c->Assign(4, make_intrusive<IntervalVal>(0.0));
-	c->Assign(5, make_intrusive<TableVal>(zeek::id::string_set));	// service
+	c->Assign(3, zeek::make_intrusive<TimeVal>(network_time));
+	c->Assign(4, zeek::make_intrusive<IntervalVal>(0.0));
+	c->Assign(5, zeek::make_intrusive<TableVal>(zeek::id::string_set));	// service
 	c->Assign(6, val_mgr->EmptyString());	// history
 
 	return c;
@@ -3386,7 +3386,7 @@ function get_current_packet%(%) : pcap_packet
 	%{
 	static auto pcap_packet = zeek::id::find_type<zeek::RecordType>("pcap_packet");
 	const Packet* p;
-	auto pkt = make_intrusive<RecordVal>(pcap_packet);
+	auto pkt = zeek::make_intrusive<RecordVal>(pcap_packet);
 
 	if ( ! current_pktsrc ||
 	     ! current_pktsrc->GetCurrentPacket(&p) )
@@ -3404,7 +3404,7 @@ function get_current_packet%(%) : pcap_packet
 	pkt->Assign(1, val_mgr->Count(uint32_t(p->ts.tv_usec)));
 	pkt->Assign(2, val_mgr->Count(p->cap_len));
 	pkt->Assign(3, val_mgr->Count(p->len));
-	pkt->Assign(4, make_intrusive<StringVal>(p->cap_len, (const char*)p->data));
+	pkt->Assign(4, zeek::make_intrusive<StringVal>(p->cap_len, (const char*)p->data));
 	pkt->Assign(5, zeek::BifType::Enum::link_encap->GetVal(p->link_type));
 
 	return pkt;
@@ -3427,7 +3427,7 @@ function get_current_packet_header%(%) : raw_pkt_hdr
 		}
 
 	static auto raw_pkt_hdr_type = zeek::id::find_type<zeek::RecordType>("raw_pkt_hdr");
-	auto hdr = make_intrusive<RecordVal>(raw_pkt_hdr_type);
+	auto hdr = zeek::make_intrusive<RecordVal>(raw_pkt_hdr_type);
 	return hdr;
 	%}
 
@@ -3521,7 +3521,7 @@ public:
 		else
 			{
 			ListVal* lv = new ListVal(zeek::TYPE_ADDR);
-			lv->Append(make_intrusive<AddrVal>("0.0.0.0"));
+			lv->Append(zeek::make_intrusive<AddrVal>("0.0.0.0"));
 			auto result = lv->ToSetVal();
 			trigger->Cache(call, result.get());
 			Unref(lv);
@@ -3555,7 +3555,7 @@ function lookup_addr%(host: addr%) : string
 	if ( ! trigger)
 		{
 		builtin_error("lookup_addr() can only be called inside a when-condition");
-		return make_intrusive<StringVal>("<error>");
+		return zeek::make_intrusive<StringVal>("<error>");
 		}
 
 	frame->SetDelayed();
@@ -3584,7 +3584,7 @@ function lookup_hostname_txt%(host: string%) : string
 	if ( ! trigger)
 		{
 		builtin_error("lookup_hostname_txt() can only be called inside a when-condition");
-		return make_intrusive<StringVal>("<error>");
+		return zeek::make_intrusive<StringVal>("<error>");
 		}
 
 	frame->SetDelayed();
@@ -3613,7 +3613,7 @@ function lookup_hostname%(host: string%) : addr_set
 	if ( ! trigger)
 		{
 		builtin_error("lookup_hostname() can only be called inside a when-condition");
-		return make_intrusive<StringVal>("<error>");
+		return zeek::make_intrusive<StringVal>("<error>");
 		}
 
 	frame->SetDelayed();
@@ -3862,8 +3862,8 @@ static bool mmdb_lookup_asn(const IPAddr& addr, MMDB_lookup_result_s& result)
 	return mmdb_lookup(addr, result, true);
 	}
 
-static IntrusivePtr<Val> mmdb_getvalue(MMDB_entry_data_s* entry_data, int status,
-                          int data_type )
+static zeek::IntrusivePtr<Val> mmdb_getvalue(MMDB_entry_data_s* entry_data, int status,
+                                             int data_type )
 	{
 	switch (status)
 		{
@@ -3873,12 +3873,12 @@ static IntrusivePtr<Val> mmdb_getvalue(MMDB_entry_data_s* entry_data, int status
 				switch (data_type)
 					{
 					case MMDB_DATA_TYPE_UTF8_STRING:
-						return make_intrusive<StringVal>(entry_data->data_size,
-						                                 entry_data->utf8_string);
+						return zeek::make_intrusive<StringVal>(
+						    entry_data->data_size, entry_data->utf8_string);
 						break;
 
 					case MMDB_DATA_TYPE_DOUBLE:
-						return make_intrusive<DoubleVal>(entry_data->double_value);
+						return zeek::make_intrusive<DoubleVal>(entry_data->double_value);
 						break;
 
 					case MMDB_DATA_TYPE_UINT32:
@@ -3998,7 +3998,7 @@ function mmdb_open_asn_db%(f: string%) : bool
 function lookup_location%(a: addr%) : geo_location
 	%{
 	static auto geo_location = zeek::id::find_type<zeek::RecordType>("geo_location");
-	auto location = make_intrusive<RecordVal>(geo_location);
+	auto location = zeek::make_intrusive<RecordVal>(geo_location);
 
 #ifdef USE_GEOIP
 	mmdb_check_loc();
@@ -4155,7 +4155,7 @@ function haversine_distance%(lat1: double, long1: double, lat2: double, long2: d
 	double a = s1 * s1 + cos(lat1 * PI/180) * cos(lat2 * PI/180) * s2 * s2;
 	double distance = 2 * RADIUS * asin(sqrt(a));
 
-	return make_intrusive<DoubleVal>(distance);
+	return zeek::make_intrusive<DoubleVal>(distance);
 	%}
 
 ## Converts UNIX file permissions given by a mode to an ASCII string.
@@ -4247,7 +4247,7 @@ function file_mode%(mode: count%): string
 
 	*p = '\0';
 
-	return make_intrusive<StringVal>(str);
+	return zeek::make_intrusive<StringVal>(str);
 	%}
 
 # ===========================================================================
@@ -4368,12 +4368,12 @@ function set_inactivity_timeout%(cid: conn_id, t: interval%): interval
 	%{
 	Connection* c = sessions->FindConnection(cid);
 	if ( ! c )
-		return make_intrusive<IntervalVal>(0.0);
+		return zeek::make_intrusive<IntervalVal>(0.0);
 
 	double old_timeout = c->InactivityTimeout();
 	c->SetInactivityTimeout(t);
 
-	return make_intrusive<IntervalVal>(old_timeout);
+	return zeek::make_intrusive<IntervalVal>(old_timeout);
 	%}
 
 # ===========================================================================
@@ -4397,9 +4397,9 @@ function open%(f: string%): file
 	const char* file = f->CheckString();
 
 	if ( streq(file, "-") )
-		return make_intrusive<Val>(make_intrusive<BroFile>(stdout, "-", "w"));
+		return zeek::make_intrusive<Val>(zeek::make_intrusive<BroFile>(stdout, "-", "w"));
 	else
-		return make_intrusive<Val>(make_intrusive<BroFile>(file, "w"));
+		return zeek::make_intrusive<Val>(zeek::make_intrusive<BroFile>(file, "w"));
 	%}
 
 ## Opens a file for writing or appending. If a file with the same name already
@@ -4414,7 +4414,7 @@ function open%(f: string%): file
 ##              rmdir unlink rename
 function open_for_append%(f: string%): file
 	%{
-	return make_intrusive<Val>(make_intrusive<BroFile>(f->CheckString(), "a"));
+	return zeek::make_intrusive<Val>(zeek::make_intrusive<BroFile>(f->CheckString(), "a"));
 	%}
 
 ## Closes an open file and flushes any buffered content.
@@ -4610,7 +4610,7 @@ function get_file_name%(f: file%): string
 	if ( ! f )
 		return val_mgr->EmptyString();
 
-	return make_intrusive<StringVal>(f->Name());
+	return zeek::make_intrusive<StringVal>(f->Name());
 	%}
 
 ## Rotates a file.
@@ -4623,18 +4623,18 @@ function get_file_name%(f: file%): string
 ## .. zeek:see:: rotate_file_by_name calc_next_rotate
 function rotate_file%(f: file%): rotate_info
 	%{
-	IntrusivePtr<RecordVal> info{AdoptRef{}, f->Rotate()};
+	zeek::IntrusivePtr<RecordVal> info{zeek::AdoptRef{}, f->Rotate()};
 
 	if ( info )
 		return info;
 
 	// Record indicating error.
 	static auto rotate_info = zeek::id::find_type<zeek::RecordType>("rotate_info");
-	info = make_intrusive<RecordVal>(rotate_info);
+	info = zeek::make_intrusive<RecordVal>(rotate_info);
 	info->Assign(0, val_mgr->EmptyString());
 	info->Assign(1, val_mgr->EmptyString());
-	info->Assign(2, make_intrusive<TimeVal>(0.0));
-	info->Assign(3, make_intrusive<TimeVal>(0.0));
+	info->Assign(2, zeek::make_intrusive<TimeVal>(0.0));
+	info->Assign(3, zeek::make_intrusive<TimeVal>(0.0));
 
 	return info;
 	%}
@@ -4650,7 +4650,7 @@ function rotate_file%(f: file%): rotate_info
 function rotate_file_by_name%(f: string%): rotate_info
 	%{
 	static auto rotate_info = zeek::id::find_type<zeek::RecordType>("rotate_info");
-	auto info = make_intrusive<RecordVal>(rotate_info);
+	auto info = zeek::make_intrusive<RecordVal>(rotate_info);
 
 	bool is_pkt_dumper = false;
 	bool is_addl_pkt_dumper = false;
@@ -4675,8 +4675,8 @@ function rotate_file_by_name%(f: string%): rotate_info
 		// Record indicating error.
 		info->Assign(0, val_mgr->EmptyString());
 		info->Assign(1, val_mgr->EmptyString());
-		info->Assign(2, make_intrusive<TimeVal>(0.0));
-		info->Assign(3, make_intrusive<TimeVal>(0.0));
+		info->Assign(2, zeek::make_intrusive<TimeVal>(0.0));
+		info->Assign(3, zeek::make_intrusive<TimeVal>(0.0));
 		return info;
 		}
 
@@ -4684,12 +4684,12 @@ function rotate_file_by_name%(f: string%): rotate_info
 
 	if ( is_pkt_dumper )
 		{
-		info->Assign(2, make_intrusive<TimeVal>(pkt_dumper->OpenTime()));
+		info->Assign(2, zeek::make_intrusive<TimeVal>(pkt_dumper->OpenTime()));
 		pkt_dumper->Open();
 		}
 
 	if ( is_addl_pkt_dumper )
-		info->Assign(2, make_intrusive<TimeVal>(addl_pkt_dumper->OpenTime()));
+		info->Assign(2, zeek::make_intrusive<TimeVal>(addl_pkt_dumper->OpenTime()));
 
 	return info;
 	%}
@@ -4708,7 +4708,7 @@ function calc_next_rotate%(i: interval%) : interval
 	static auto base_time = log_rotate_base_time->AsString()->CheckString();
 
 	double base = parse_rotate_base_time(base_time);
-	return make_intrusive<IntervalVal>(calc_next_rotate(network_time, i, base));
+	return zeek::make_intrusive<IntervalVal>(calc_next_rotate(network_time, i, base));
 	%}
 
 ## Returns the size of a given file.
@@ -4721,9 +4721,9 @@ function file_size%(f: string%) : double
 	struct stat s;
 
 	if ( stat(f->CheckString(), &s) < 0 )
-		return make_intrusive<DoubleVal>(-1.0);
+		return zeek::make_intrusive<DoubleVal>(-1.0);
 
-	return make_intrusive<DoubleVal>(double(s.st_size));
+	return zeek::make_intrusive<DoubleVal>(double(s.st_size));
 	%}
 
 ## Prevents escaping of non-ASCII characters when writing to a file.
@@ -5098,7 +5098,7 @@ function anonymize_addr%(a: addr, cl: IPAddrAnonymizationClass%): addr
 		{
 		const uint32_t* bytes;
 		a->AsAddr().GetBytes(&bytes);
-		return make_intrusive<AddrVal>(zeek::detail::anonymize_ip(*bytes,
+		return zeek::make_intrusive<AddrVal>(zeek::detail::anonymize_ip(*bytes,
 		        static_cast<zeek::detail::ip_addr_anonymization_class_t>(anon_class)));
 		}
 	%}
diff --git a/src/zeekygen/IdentifierInfo.cc b/src/zeekygen/IdentifierInfo.cc
index ff0b994f73..ee24605743 100644
--- a/src/zeekygen/IdentifierInfo.cc
+++ b/src/zeekygen/IdentifierInfo.cc
@@ -11,7 +11,7 @@
 using namespace std;
 using namespace zeekygen;
 
-IdentifierInfo::IdentifierInfo(IntrusivePtr<zeek::detail::ID> arg_id, ScriptInfo* script)
+IdentifierInfo::IdentifierInfo(zeek::IntrusivePtr<zeek::detail::ID> arg_id, ScriptInfo* script)
 	: Info(),
 	  comments(), id(std::move(arg_id)), initial_val(), redefs(), fields(),
 	  last_field_seen(), declaring_script(script)
@@ -32,7 +32,7 @@ IdentifierInfo::~IdentifierInfo()
 	}
 
 void IdentifierInfo::AddRedef(const string& script, zeek::detail::InitClass ic,
-                              IntrusivePtr<zeek::detail::Expr> init_expr, const vector<string>& comments)
+                              zeek::IntrusivePtr<zeek::detail::Expr> init_expr, const vector<string>& comments)
 	{
 	Redefinition* redef = new Redefinition(script, ic, std::move(init_expr), comments);
 	redefs.push_back(redef);
@@ -142,7 +142,7 @@ time_t IdentifierInfo::DoGetModificationTime() const
 IdentifierInfo::Redefinition::Redefinition(
 	std::string arg_script,
 	zeek::detail::InitClass arg_ic,
-	IntrusivePtr<zeek::detail::Expr> arg_expr,
+	zeek::IntrusivePtr<zeek::detail::Expr> arg_expr,
 	std::vector<std::string> arg_comments)
 	: from_script(std::move(arg_script)),
 	  ic(arg_ic),
diff --git a/src/zeekygen/IdentifierInfo.h b/src/zeekygen/IdentifierInfo.h
index 06d90897a9..17bc2a78b6 100644
--- a/src/zeekygen/IdentifierInfo.h
+++ b/src/zeekygen/IdentifierInfo.h
@@ -32,7 +32,7 @@ public:
 	 * @param script The info object associated with the script in which \a id
 	 * is declared.
 	 */
-	IdentifierInfo(IntrusivePtr<zeek::detail::ID> id, ScriptInfo* script);
+	IdentifierInfo(zeek::IntrusivePtr<zeek::detail::ID> id, ScriptInfo* script);
 
 	/**
 	 * Dtor.  Releases any references to script-level objects.
@@ -42,7 +42,7 @@ public:
 	/**
 	 * Returns the initial value of the identifier.
 	 */
-	const IntrusivePtr<Val>& InitialVal() const
+	const zeek::IntrusivePtr<Val>& InitialVal() const
 		{ return initial_val; }
 
 	/**
@@ -71,7 +71,7 @@ public:
 	 * @param comments Comments associated with the redef statement.
 	 */
 	void AddRedef(const std::string& from_script, zeek::detail::InitClass ic,
-	              IntrusivePtr<zeek::detail::Expr> init_expr,
+	              zeek::IntrusivePtr<zeek::detail::Expr> init_expr,
 	              const std::vector<std::string>& comments);
 
 	/**
@@ -128,11 +128,11 @@ public:
 	struct Redefinition {
 		std::string from_script; /**< Name of script doing the redef. */
 		zeek::detail::InitClass ic;
-		IntrusivePtr<zeek::detail::Expr> init_expr;
+		zeek::IntrusivePtr<zeek::detail::Expr> init_expr;
 		std::vector<std::string> comments; /**< Zeekygen comments on redef. */
 
 		Redefinition(std::string arg_script, zeek::detail::InitClass arg_ic,
-		             IntrusivePtr<zeek::detail::Expr> arg_expr,
+		             zeek::IntrusivePtr<zeek::detail::Expr> arg_expr,
 		             std::vector<std::string> arg_comments);
 
 		~Redefinition();
@@ -174,8 +174,8 @@ private:
 	typedef std::map<std::string, RecordField*> record_field_map;
 
 	std::vector<std::string> comments;
-	IntrusivePtr<zeek::detail::ID> id;
-	IntrusivePtr<Val> initial_val;
+	zeek::IntrusivePtr<zeek::detail::ID> id;
+	zeek::IntrusivePtr<Val> initial_val;
 	redef_list redefs;
 	record_field_map fields;
 	RecordField* last_field_seen;
diff --git a/src/zeekygen/Manager.cc b/src/zeekygen/Manager.cc
index c114983f26..117dac8652 100644
--- a/src/zeekygen/Manager.cc
+++ b/src/zeekygen/Manager.cc
@@ -216,7 +216,7 @@ void Manager::ModuleUsage(const string& path, const string& module)
 	        module.c_str(), name.c_str());
 	}
 
-IdentifierInfo* Manager::CreateIdentifierInfo(IntrusivePtr<zeek::detail::ID> id, ScriptInfo* script)
+IdentifierInfo* Manager::CreateIdentifierInfo(zeek::IntrusivePtr<zeek::detail::ID> id, ScriptInfo* script)
 	{
 	const auto& id_name = id->Name();
 	auto prev = identifiers.GetInfo(id_name);
@@ -247,7 +247,7 @@ IdentifierInfo* Manager::CreateIdentifierInfo(IntrusivePtr<zeek::detail::ID> id,
 	return rval;
 	}
 
-void Manager::StartType(IntrusivePtr<zeek::detail::ID> id)
+void Manager::StartType(zeek::IntrusivePtr<zeek::detail::ID> id)
 	{
 	if ( disabled )
 		return;
@@ -278,7 +278,7 @@ static bool IsEnumType(zeek::detail::ID* id)
 	return id->IsType() ? id->GetType()->Tag() == zeek::TYPE_ENUM : false;
 	}
 
-void Manager::Identifier(IntrusivePtr<zeek::detail::ID> id)
+void Manager::Identifier(zeek::IntrusivePtr<zeek::detail::ID> id)
 	{
 	if ( disabled )
 		return;
@@ -361,7 +361,7 @@ void Manager::RecordField(const zeek::detail::ID* id, const zeek::TypeDecl* fiel
 	}
 
 void Manager::Redef(const zeek::detail::ID* id, const string& path,
-                    zeek::detail::InitClass ic, IntrusivePtr<zeek::detail::Expr> init_expr)
+                    zeek::detail::InitClass ic, zeek::IntrusivePtr<zeek::detail::Expr> init_expr)
 	{
 	if ( disabled )
 		return;
diff --git a/src/zeekygen/Manager.h b/src/zeekygen/Manager.h
index cd7eefca50..2dff34318e 100644
--- a/src/zeekygen/Manager.h
+++ b/src/zeekygen/Manager.h
@@ -111,14 +111,14 @@ public:
 	 * Signal that a record or enum type is now being parsed.
 	 * @param id The record or enum type identifier.
 	 */
-	void StartType(IntrusivePtr<zeek::detail::ID> id);
+	void StartType(zeek::IntrusivePtr<zeek::detail::ID> id);
 
 	/**
 	 * Register a script-level identifier for which information/documentation
 	 * will be gathered.
 	 * @param id The script-level identifier.
 	 */
-	void Identifier(IntrusivePtr<zeek::detail::ID> id);
+	void Identifier(zeek::IntrusivePtr<zeek::detail::ID> id);
 
 	/**
 	 * Register a record-field for which information/documentation will be
@@ -140,7 +140,7 @@ public:
 	 * @param init_expr The intiialization expression that was used.
 	 */
 	void Redef(const zeek::detail::ID* id, const std::string& path,
-	           zeek::detail::InitClass ic, IntrusivePtr<zeek::detail::Expr> init_expr);
+	           zeek::detail::InitClass ic, zeek::IntrusivePtr<zeek::detail::Expr> init_expr);
 	void Redef(const zeek::detail::ID* id, const std::string& path,
 	           zeek::detail::InitClass ic = zeek::detail::INIT_NONE);
 
@@ -218,7 +218,7 @@ private:
 	typedef std::vector<std::string> comment_buffer_t;
 	typedef std::map<std::string, comment_buffer_t> comment_buffer_map_t;
 
-	IdentifierInfo* CreateIdentifierInfo(IntrusivePtr<zeek::detail::ID> id, ScriptInfo* script);
+	IdentifierInfo* CreateIdentifierInfo(zeek::IntrusivePtr<zeek::detail::ID> id, ScriptInfo* script);
 
 	bool disabled;
 	comment_buffer_t comment_buffer; // For whatever next identifier comes in.
diff --git a/src/zeekygen/zeekygen.bif b/src/zeekygen/zeekygen.bif
index beaff682b0..1ce3daada7 100644
--- a/src/zeekygen/zeekygen.bif
+++ b/src/zeekygen/zeekygen.bif
@@ -9,9 +9,9 @@
 #include "zeekygen/ScriptInfo.h"
 #include "util.h"
 
-static IntrusivePtr<StringVal> comments_to_val(const vector<string>& comments)
+static zeek::IntrusivePtr<StringVal> comments_to_val(const vector<string>& comments)
 	{
-	return make_intrusive<StringVal>(implode_string_vector(comments));
+	return zeek::make_intrusive<StringVal>(implode_string_vector(comments));
 	}
 %%}
 
diff --git a/testing/btest/plugins/func-hook-plugin/src/Plugin.cc b/testing/btest/plugins/func-hook-plugin/src/Plugin.cc
index c71788fa86..99348affe3 100644
--- a/testing/btest/plugins/func-hook-plugin/src/Plugin.cc
+++ b/testing/btest/plugins/func-hook-plugin/src/Plugin.cc
@@ -41,9 +41,8 @@ static void describe_hook_args(const plugin::HookArgumentList& args, ODesc* d)
 		}
 	}
 
-std::pair<bool, IntrusivePtr<Val>> Plugin::HookFunctionCall(const Func* func,
-                                                            Frame* frame,
-                                                            zeek::Args* args)
+std::pair<bool, zeek::IntrusivePtr<Val>> Plugin::HookFunctionCall(
+	const Func* func, Frame* frame, zeek::Args* args)
 	{
 	ODesc d;
 	d.SetShort();
diff --git a/testing/btest/plugins/func-hook-plugin/src/Plugin.h b/testing/btest/plugins/func-hook-plugin/src/Plugin.h
index d437213719..19bccd4386 100644
--- a/testing/btest/plugins/func-hook-plugin/src/Plugin.h
+++ b/testing/btest/plugins/func-hook-plugin/src/Plugin.h
@@ -10,9 +10,8 @@ class Plugin : public zeek::plugin::Plugin
 {
 protected:
 
-	std::pair<bool, IntrusivePtr<Val>> HookFunctionCall(const Func* func,
-	                                                    Frame* frame,
-	                                                    zeek::Args* args) override;
+	std::pair<bool, zeek::IntrusivePtr<Val>> HookFunctionCall(
+		const Func* func, Frame* frame, zeek::Args* args) override;
 
 	void MetaHookPre(zeek::plugin::HookType hook,
 	                 const zeek::plugin::HookArgumentList& args) override;
diff --git a/testing/btest/plugins/protocol-plugin/src/foo-analyzer.pac b/testing/btest/plugins/protocol-plugin/src/foo-analyzer.pac
index 0c1fdbfa1a..051ffaff7c 100644
--- a/testing/btest/plugins/protocol-plugin/src/foo-analyzer.pac
+++ b/testing/btest/plugins/protocol-plugin/src/foo-analyzer.pac
@@ -3,7 +3,7 @@ refine connection Foo_Conn += {
 
 	function Foo_data(msg: Foo_Message): bool
 		%{
-		auto data = make_intrusive<StringVal>(${msg.data}.length(), (const char*) ${msg.data}.data());
+		auto data = zeek::make_intrusive<StringVal>(${msg.data}.length(), (const char*) ${msg.data}.data());
 		zeek::BifEvent::enqueue_foo_message(bro_analyzer(), bro_analyzer()->Conn(), std::move(data));
 		return true;
 		%}