n8n-io/n8n · error · SecurityError

'${name}' is a reserved SDK function name and cannot be used

Error message

'${name}' is a reserved SDK function name and cannot be used as a variable name. Use a different name like 'my${Name}'.

What it means

The SDK injects top-level builder functions (`workflow`, `node`, `trigger`, `ifElse`, etc.) into the interpreter scope. Declaring a variable whose name matches a non-auto-renameable SDK function would shadow that builder and silently break workflow construction, so the interpreter throws a `SecurityError`. Auto-renameable subnode functions (`tool`, `memory`, `languageModel`, etc.) are silently renamed to `myTool`, `myMemory`, etc. instead of throwing.

Source

Thrown at packages/@n8n/workflow-sdk/src/ast-interpreter/interpreter.ts:125

					'Destructuring in variable declaration',
					declarator.loc ?? undefined,
					this.sourceCode,
				);
			}

			const name = declarator.id.name;

			// Check for SDK function name collisions
			if (isAllowedSDKFunction(name)) {
				if (isAutoRenameableSDKFunction(name)) {
					// Auto-rename subnode variables that collide with SDK function names
					const safeName = this.generateSafeName(name);
					const value = declarator.init ? this.evaluate(declarator.init) : undefined;
					this.renamedVariables.set(name, safeName);
					this.variables.set(safeName, value);
					continue;
				}
				throw new SecurityError(
					name,
					declarator.loc ?? undefined,
					this.sourceCode,
					`'${name}' is a reserved SDK function name and cannot be used as a variable name. ` +
						`Use a different name like 'my${name.charAt(0).toUpperCase() + name.slice(1)}'.`,
				);
			}

			const value = declarator.init ? this.evaluate(declarator.init) : undefined;
			this.variables.set(name, value);
		}
	}

	/**
	 * Evaluate an expression and return its value.
	 */
	private evaluate(node: ESTree.Expression | ESTree.SpreadElement | null): unknown {
		if (node === null) return undefined;

View on GitHub (pinned to 5ac6606e81)

Solutions

1. Rename the variable — the error message suggests `my${CapitalizedName}` (e.g., `myNode`, `myWorkflow`)
2. Use a domain-specific name: `httpNode` instead of `node`, `wfConfig` instead of `workflow`
3. If the name is a subnode builder (`tool`, `memory`, etc.), the auto-rename handles it — but avoid relying on the rename for readability

Example fix

// before
const node = trigger({ type: 'manual' });

// after
const manualTrigger = trigger({ type: 'manual' });

import {
  ALLOWED_SDK_FUNCTIONS,
  AUTO_RENAMEABLE_SDK_FUNCTIONS,
} from '@n8n/workflow-sdk/ast-interpreter/validators';

const RESERVED = new Set(
  [...ALLOWED_SDK_FUNCTIONS].filter((n) => !AUTO_RENAMEABLE_SDK_FUNCTIONS.has(n)),
);

function checkVarNames(code: string): string[] {
  const ast = parse(code, { ecmaVersion: 'latest', sourceType: 'module' });
  const violations: string[] = [];
  walk(ast, (node) => {
    if (
      node.type === 'VariableDeclarator' &&
      node.id.type === 'Identifier' &&
      RESERVED.has(node.id.name)
    ) {
      violations.push(node.id.name);
    }
  });
  return violations;
}

import { SecurityError } from '@n8n/workflow-sdk/ast-interpreter/errors';

try {
  interpretSDKCode(sdkCode, sdkFunctions);
} catch (e) {
  if (e instanceof SecurityError && e.message.includes('reserved SDK function name')) {
    // extract the suggested rename from the error message
  }
  throw e;
}

When it happens

Trigger: Writing `const node = 'Http'` or `const workflow = myConfig` in SDK code. At interpreter.ts:116, `isAllowedSDKFunction(name)` returns true; at line 117, `isAutoRenameableSDKFunction(name)` returns false for core builders and control-flow functions, so execution reaches the `throw new SecurityError` at line 125. The non-renameable names are: `workflow`, `node`, `trigger`, `sticky`, `placeholder`, `newCredential`, `ifElse`, `switchCase`, `merge`, `splitInBatches`, `nextBatch`, `fromAi`, `nodeJson`.

Common situations: Using `node` as a generic iteration or config variable; naming a config object `workflow`; refactoring code that used these words before they became SDK reserved names.

Related errors

• Unsupported syntax: 'Dynamic method name' is not allowed in
• Method '${methodName}' is not an allowed SDK method. Allowed
• Unsupported syntax: 'Dynamic property access' is not allowed
• Unsupported syntax: 'Object key type ${prop.key.type}' is no
• LangSmithTelemetry creates its own tracer — do not use .otlp

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/03658567e26b3510. Report an issue: GitHub.