diff --git a/CHANGELOG.md b/CHANGELOG.md
index a961ebaf..59232ac9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,6 +20,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- **`apps/demo`** — added `whatwg-url`, `tr46`, and `webidl-conversions` as explicit devDependencies and to `vercel.json` `includeFiles`. These are transitive dependencies of `node-fetch@2.7.0` (used by `cross-fetch@4.1.0`) that must be bundled into Vercel's serverless function. Without them, the deployment fails with `Cannot find module 'whatwg-url/index.js'`.
 - **`apps/demo/scripts/patch-symlinks.cjs`** — enhanced to automatically resolve and copy ALL transitive dependencies before dereferencing symlinks. Previously, only direct dependencies listed in `apps/demo/package.json` were available after symlink dereferencing, causing `ERR_MODULE_NOT_FOUND` for transitive deps like `@objectstack/rest`, `zod`, `pino`, `better-auth`, etc. The script now walks each package's pnpm virtual store context (`.pnpm/<name>@<ver>/node_modules/`) and copies any missing sibling dependency into the top-level `node_modules/`, repeating until the full transitive closure is present.
 - **`apps/demo`** — added explicit `@objectstack/spec` and `zod` devDependencies as defense-in-depth for Vercel deployment.
 - **`@objectql/types`** — moved `@objectstack/spec` and `zod` from `devDependencies` to `dependencies`. The compiled JS output contains runtime imports of `@objectstack/spec` (via `z.infer<typeof Data.X>` patterns), so they must be declared as production dependencies.
diff --git a/apps/demo/package.json b/apps/demo/package.json
index 71bf7efd..b4facab9 100644
--- a/apps/demo/package.json
+++ b/apps/demo/package.json
@@ -51,6 +51,9 @@
     "ws": "^8.19.0",
     "cross-fetch": "^4.1.0",
     "node-fetch": "^2.7.0",
+    "whatwg-url": "^5.0.0",
+    "tr46": "^0.0.3",
+    "webidl-conversions": "^3.0.1",
     "zod": "^4.3.6"
   },
   "engines": {
diff --git a/apps/demo/vercel.json b/apps/demo/vercel.json
index 60e6dbf4..3560828a 100644
--- a/apps/demo/vercel.json
+++ b/apps/demo/vercel.json
@@ -7,7 +7,7 @@
     "api/**/*.ts": {
       "memory": 1024,
       "maxDuration": 60,
-      "includeFiles": "node_modules/{@object-ui/*/dist,@objectstack/*/dist,@objectql/*/dist,@libsql,@neon-rs,libsql,detect-libc,js-base64,promise-limit,nanoid,ws,cross-fetch,node-fetch}/**"
+      "includeFiles": "node_modules/{@object-ui/*/dist,@objectstack/*/dist,@objectql/*/dist,@libsql,@neon-rs,libsql,detect-libc,js-base64,promise-limit,nanoid,ws,cross-fetch,node-fetch,whatwg-url,tr46,webidl-conversions}/**"
     }
   },
   "rewrites": [
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 1f243298..a9a2efee 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -255,9 +255,18 @@ importers:
       promise-limit:
         specifier: ^2.7.0
         version: 2.7.0
+      tr46:
+        specifier: ^0.0.3
+        version: 0.0.3
       typescript:
         specifier: ^5.9.3
         version: 5.9.3
+      webidl-conversions:
+        specifier: ^3.0.1
+        version: 3.0.1
+      whatwg-url:
+        specifier: ^5.0.0
+        version: 5.0.0
       ws:
         specifier: ^8.19.0
         version: 8.19.0