JS files in the 'server' directory (or any path with a 'server' component') are not sent to the client.
Everything else is.
Putting code inside an `if (Meteor.isServer)` block doesn't keep it from the client. Now someday we might statically analyze the code for clauses like this and keep them out of the client bundle -- the first step is greenspan's jsparse package -- but not likely in the short term.