fix: repair Telegram setup package entry

CHANGELOG.md

@@ -109,6 +109,7 @@ Docs: https://docs.openclaw.ai
 - Agents/model resolution: let explicit `openai-codex/gpt-5.4` selection prefer provider runtime metadata when it reports a larger context window, keeping configured Codex runs aligned with the live provider limits. (#62694) Thanks @ruclaw7.
 - Agents/model resolution: keep explicit-model runtime comparisons on the configured workspace plugin registry, so workspace-installed providers do not silently fall back to stale explicit metadata during runtime model lookup.
 - Providers/Z.AI: default onboarding and endpoint detection to GLM-5.1 instead of GLM-5. (#61998) Thanks @serg0x.
+- Telegram/setup: load setup and secret contracts through packaged top-level sidecars so installed 2026.4.7 npm builds no longer try to import missing `dist/extensions/telegram/src/*` files during gateway startup.
 
 ## 2026.4.5
 

extensions/telegram/index.ts

@@ -10,7 +10,7 @@ export default defineBundledChannelEntry({
     exportName: "telegramPlugin",
   },
   secrets: {
-    specifier: "./src/secret-contract.js",
+    specifier: "./secret-contract-api.js",
     exportName: "channelSecrets",
   },
   runtime: {

extensions/telegram/secret-contract-api.ts

@@ -1,4 +1,5 @@
 export {
+  channelSecrets,
   collectRuntimeConfigAssignments,
   secretTargetRegistryEntries,
 } from "./src/secret-contract.js";

extensions/telegram/setup-entry.ts

@@ -3,11 +3,11 @@ import { defineBundledChannelSetupEntry } from "openclaw/plugin-sdk/channel-entr
 export default defineBundledChannelSetupEntry({
   importMetaUrl: import.meta.url,
   plugin: {
-    specifier: "./src/channel.setup.js",
+    specifier: "./setup-plugin-api.js",
     exportName: "telegramSetupPlugin",
   },
   secrets: {
-    specifier: "./src/secret-contract.js",
+    specifier: "./secret-contract-api.js",
     exportName: "channelSecrets",
   },
 });

extensions/telegram/setup-plugin-api.ts

@@ -0,0 +1,3 @@
+// Keep bundled setup entry imports narrow so setup loads do not pull the
+// broader Telegram channel plugin surface.
+export { telegramSetupPlugin } from "./src/channel.setup.js";

test/scripts/bundled-plugin-build-entries.test.ts

@@ -1,3 +1,4 @@
+import fs from "node:fs";
 import { describe, expect, it } from "vitest";
 import {
   listBundledPluginBuildEntries,
@@ -47,4 +48,16 @@ describe("bundled plugin build entries", () => {
 
     expect(artifacts).toContain("dist/extensions/matrix/plugin-entry.handlers.runtime.js");
   });
+
+  it("keeps the Telegram setup entry on packed top-level sidecars", () => {
+    const setupEntry = fs.readFileSync("extensions/telegram/setup-entry.ts", "utf8");
+    const artifacts = listBundledPluginPackArtifacts();
+
+    expect(setupEntry).toContain('specifier: "./setup-plugin-api.js"');
+    expect(setupEntry).toContain('specifier: "./secret-contract-api.js"');
+    expect(setupEntry).not.toContain("./src/channel.setup.js");
+    expect(setupEntry).not.toContain("./src/secret-contract.js");
+    expect(artifacts).toContain("dist/extensions/telegram/setup-plugin-api.js");
+    expect(artifacts).toContain("dist/extensions/telegram/secret-contract-api.js");
+  });
 });