Server-only module reachable from client code
Why it matters
Everything a "use client" module imports (transitively, at runtime) is bundled for the browser. Modules marked server-only, next/headers, Node built-ins or configured server modules (DB clients, secrets) either break the build or leak server code.
Fix
Break the chain shown in chain: import a type-only binding (import type), move the server call into a Server Component/Action, or split the module.
Credit
From the Next.js team
Documents 'environment poisoning': server-only code imported into a Client Component leaks into the bundle, and the server-only package turns that into a build error.