refactor(edge): 抽取边缘运行时共享包并完成 Phase 3 重构

- 新增 internal/apps/edge/，三组件改为薄包装，删除 3000+ 行重复代码
- Agent 心跳周期下沉至 heartbeat/cycle.go
- 协议类型迁入 pkg/protocol/agent.go
- 补充设计文档与 changelog

internal/apps/flared/config/config.go

@@ -7,38 +7,11 @@ import (
 	"path/filepath"
 	"strings"
 	"time"
+
+	edgeconfig "github.com/Rain-kl/Wavelet/internal/apps/edge/config"
 )
 
-type MillisecondDuration time.Duration
-
-func (d *MillisecondDuration) UnmarshalJSON(b []byte) error {
-	var v interface{}
-	if err := json.Unmarshal(b, &v); err != nil {
-		return err
-	}
-	switch value := v.(type) {
-	case float64:
-		*d = MillisecondDuration(time.Duration(value) * time.Millisecond)
-		return nil
-	case string:
-		duration, err := time.ParseDuration(value)
-		if err != nil {
-			return err
-		}
-		*d = MillisecondDuration(duration)
-		return nil
-	default:
-		return errors.New("invalid duration format")
-	}
-}
-
-func (d MillisecondDuration) Duration() time.Duration {
-	return time.Duration(d)
-}
-
-func (d MillisecondDuration) String() string {
-	return time.Duration(d).String()
-}
+type MillisecondDuration = edgeconfig.MillisecondDuration
 
 type Config struct {
 	ServerURL         string              `json:"server_url"`

internal/apps/flared/flared/runner.go

@@ -3,8 +3,8 @@ package flared
 import (
 	"context"
 	"log/slog"
-	"time"
 
+	edgerunner "github.com/Rain-kl/Wavelet/internal/apps/edge/runner"
 	"github.com/Rain-kl/Wavelet/internal/apps/flared/config"
 	"github.com/Rain-kl/Wavelet/internal/apps/flared/frpc"
 	"github.com/Rain-kl/Wavelet/internal/apps/flared/heartbeat"
@@ -23,31 +23,17 @@ type Runner struct {
 }
 
 func (r *Runner) Run(ctx context.Context) error {
-	// Start background services
 	go r.HeartbeatService.Run(ctx)
 	go r.SyncService.Run(ctx)
 
-	// WebSocket reconnection loop
-	for {
-		select {
-		case <-ctx.Done():
-			r.FrpcManager.Stop()
-			return ctx.Err()
-		default:
-		}
-
-		conn, err := r.WebSocketService.Connect(ctx)
-		if err != nil {
-			slog.Error("flared ws connect failed, will retry", "error", err)
-			r.sleepContext(ctx, 5*time.Second)
-			continue
-		}
-
+	return edgerunner.RunWSReconnectLoop(ctx, edgerunner.WSReconnectConfig{
+		ComponentName: "flared",
+		OnShutdown:    r.FrpcManager.Stop,
+	}, func(ctx context.Context) (edgerunner.WSConnection, error) {
+		return r.WebSocketService.Connect(ctx)
+	}, func(ctx context.Context, conn edgerunner.WSConnection) {
 		r.handleConnection(ctx, conn)
-		_ = conn.Close()
-		slog.Info("flared ws connection closed, reconnecting...")
-		r.sleepContext(ctx, 2*time.Second)
-	}
+	})
 }
 
 type flaredWSHandler struct {
@@ -73,13 +59,11 @@ func (h *flaredWSHandler) OnClose(err error) {
 	slog.Error("flared ws receive failed", "error", err)
 }
 
-func (r *Runner) handleConnection(ctx context.Context, conn *wsclient.Connection) {
-	_ = conn.RunReceiveLoop(ctx, &flaredWSHandler{runner: r})
-}
-
-func (r *Runner) sleepContext(ctx context.Context, d time.Duration) {
-	select {
-	case <-ctx.Done():
-	case <-time.After(d):
+func (r *Runner) handleConnection(ctx context.Context, conn edgerunner.WSConnection) {
+	wsConn, ok := conn.(*wsclient.Connection)
+	if !ok {
+		slog.Error("flared ws connection has unexpected type")
+		return
 	}
-}
+	_ = wsConn.RunReceiveLoop(ctx, &flaredWSHandler{runner: r})
+}

internal/apps/flared/heartbeat/service.go

@@ -3,23 +3,16 @@ package heartbeat
 import (
 	"context"
 	"log/slog"
-	"net"
-	"time"
 
+	edgeheartbeat "github.com/Rain-kl/Wavelet/internal/apps/edge/heartbeat"
+	"github.com/Rain-kl/Wavelet/internal/apps/edge/nodeip"
 	"github.com/Rain-kl/Wavelet/internal/apps/flared/config"
 	"github.com/Rain-kl/Wavelet/internal/apps/flared/frpc"
 	"github.com/Rain-kl/Wavelet/internal/apps/flared/httpclient"
 	"github.com/Rain-kl/Wavelet/internal/apps/flared/updater"
-	"github.com/Rain-kl/Wavelet/pkg/geoip"
-	"github.com/Rain-kl/Wavelet/pkg/geoip/iputil"
 	service "github.com/Rain-kl/Wavelet/pkg/protocol"
 )
 
-var (
-	lookupOutboundIP = geoip.GetOutboundIP
-	lookupLocalIP    = detectLocalNodeIP
-)
-
 type Service struct {
 	client      *httpclient.Client
 	frpcManager *frpc.Manager
@@ -37,32 +30,17 @@ func New(client *httpclient.Client, manager *frpc.Manager, cfg *config.Config) *
 }
 
 func (s *Service) Run(ctx context.Context) {
-	ticker := time.NewTicker(s.config.HeartbeatInterval.Duration())
-	defer ticker.Stop()
-
-	// initial heartbeat
-	s.doHeartbeat(ctx)
-
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-ticker.C:
-			s.doHeartbeat(ctx)
-		}
-	}
+	edgeheartbeat.RunLoop(ctx, s.config.HeartbeatInterval.Duration(), s.doHeartbeat)
 }
 
 func (s *Service) doHeartbeat(ctx context.Context) {
 	slog.Debug("sending flared heartbeat")
 
-	ip := detectNodeIP()
-
 	payload := service.FlaredHeartbeatPayload{
 		ClientVersion:   config.Version,
 		FrpVersion:      s.frpcManager.GetVersion(),
-		IP:              ip,
-		TunnelStatus:    "running", // TODO implement proper status tracking
+		IP:              nodeip.Detect(),
+		TunnelStatus:    "running",
 		ConnectedRelays: s.frpcManager.GetConnectedRelays(),
 		CurrentVersion:  s.frpcManager.GetCurrentConfigVersion(),
 		CurrentChecksum: s.frpcManager.GetCurrentConfigChecksum(),
@@ -76,84 +54,19 @@ func (s *Service) doHeartbeat(ctx context.Context) {
 	slog.Debug("flared heartbeat succeeded")
 
 	if resp != nil && resp.TunnelSettings != nil {
-		s.tryAutoUpdate(ctx, resp.TunnelSettings)
+		edgeheartbeat.TryAutoUpdate(ctx, s.updater, tunnelSettingsToAutoUpdate(resp.TunnelSettings), "flared")
 	}
 }
 
-func (s *Service) tryAutoUpdate(ctx context.Context, settings *service.RelaySettings) {
-	if settings == nil || s.updater == nil {
-		return
+func tunnelSettingsToAutoUpdate(settings *service.RelaySettings) *edgeheartbeat.AutoUpdateSettings {
+	if settings == nil {
+		return nil
 	}
-	force := settings.UpdateNow
-	shouldCheck := settings.AutoUpdate || force
-	if !shouldCheck || settings.UpdateRepo == "" {
-		return
+	return &edgeheartbeat.AutoUpdateSettings{
+		AutoUpdate:    settings.AutoUpdate,
+		UpdateNow:     settings.UpdateNow,
+		UpdateRepo:    settings.UpdateRepo,
+		UpdateChannel: settings.UpdateChannel,
+		UpdateTag:     settings.UpdateTag,
 	}
-	channel := "stable"
-	if force && settings.UpdateChannel != "" {
-		channel = settings.UpdateChannel
-	}
-	slog.Info("checking for client updates", "repo", settings.UpdateRepo, "channel", channel, "force", force)
-	err := s.updater.CheckAndUpdate(ctx, settings.UpdateRepo, updater.UpdateOptions{
-		Channel: channel,
-		TagName: settings.UpdateTag,
-		Force:   force,
-	})
-	if err != nil {
-		slog.Error("client update check failed", "error", err)
-	}
-}
-
-func detectNodeIP() string {
-	if ip := detectOutboundNodeIP(); ip != "" {
-		return ip
-	}
-	return lookupLocalIP()
-}
-
-func detectOutboundNodeIP() string {
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-	ip, err := lookupOutboundIP(ctx)
-	if err != nil || ip == nil {
-		return ""
-	}
-	return ip.String()
-}
-
-func detectLocalNodeIP() string {
-	interfaces, err := net.Interfaces()
-	if err != nil {
-		return ""
-	}
-	bestIP := ""
-	bestPriority := -1
-	for _, iface := range interfaces {
-		if iface.Flags&net.FlagUp == 0 || iface.Flags&net.FlagLoopback != 0 {
-			continue
-		}
-		addrs, err := iface.Addrs()
-		if err != nil {
-			continue
-		}
-		for _, addr := range addrs {
-			ipNet, ok := addr.(*net.IPNet)
-			if !ok || ipNet.IP == nil || ipNet.IP.IsLoopback() {
-				continue
-			}
-			ipv4 := ipNet.IP.To4()
-			if ipv4 == nil {
-				continue
-			}
-			priority := iputil.Score(ipv4)
-			if priority > bestPriority {
-				bestIP = ipv4.String()
-				bestPriority = priority
-			}
-			if bestPriority == 2 {
-				return bestIP
-			}
-		}
-	}
-	return bestIP
-}
+}

internal/apps/flared/httpclient/client.go

@@ -1,16 +1,10 @@
 package httpclient
 
 import (
-	"bytes"
 	"context"
-	"encoding/json"
-	"errors"
-	"io"
-	"log/slog"
-	"net/http"
-	"strings"
 	"time"
 
+	edgehttp "github.com/Rain-kl/Wavelet/internal/apps/edge/httpclient"
 	service "github.com/Rain-kl/Wavelet/pkg/protocol"
 )
 
@@ -20,27 +14,21 @@ type APIResponse[T any] struct {
 }
 
 type Client struct {
-	baseURL    string
-	token      string
-	httpClient *http.Client
+	base *edgehttp.Client
 }
 
 func New(baseURL string, token string, timeout time.Duration) *Client {
 	return &Client{
-		baseURL: strings.TrimRight(baseURL, "/"),
-		token:   token,
-		httpClient: &http.Client{
-			Timeout: timeout,
-		},
+		base: edgehttp.New(baseURL, token, timeout, "X-Tunnel-Token"),
 	}
 }
 
 func (c *Client) Heartbeat(ctx context.Context, payload service.FlaredHeartbeatPayload) (*service.FlaredHeartbeatResponse, error) {
 	resp := APIResponse[service.FlaredHeartbeatResponse]{}
-	if err := c.postJSON(ctx, "/api/v1/tunnel/heartbeat", payload, &resp); err != nil {
+	if err := c.base.PostJSON(ctx, "/api/v1/tunnel/heartbeat", payload, &resp); err != nil {
 		return nil, err
 	}
-	if err := apiError(resp.ErrorMsg); err != nil {
+	if err := edgehttp.APIError(resp.ErrorMsg); err != nil {
 		return nil, err
 	}
 	return &resp.Data, nil
@@ -48,10 +36,10 @@ func (c *Client) Heartbeat(ctx context.Context, payload service.FlaredHeartbeatP
 
 func (c *Client) GetActiveConfig(ctx context.Context) (*service.FlaredTunnelConfigResponse, error) {
 	resp := APIResponse[service.FlaredTunnelConfigResponse]{}
-	if err := c.getJSON(ctx, "/api/v1/tunnel/config/active", &resp); err != nil {
+	if err := c.base.GetJSON(ctx, "/api/v1/tunnel/config/active", &resp); err != nil {
 		return nil, err
 	}
-	if err := apiError(resp.ErrorMsg); err != nil {
+	if err := edgehttp.APIError(resp.ErrorMsg); err != nil {
 		return nil, err
 	}
 	return &resp.Data, nil
@@ -59,85 +47,12 @@ func (c *Client) GetActiveConfig(ctx context.Context) (*service.FlaredTunnelConf
 
 func (c *Client) ReportApplyLog(ctx context.Context, payload service.ApplyLogPayload) error {
 	resp := APIResponse[any]{}
-	if err := c.postJSON(ctx, "/api/v1/tunnel/apply-log", payload, &resp); err != nil {
+	if err := c.base.PostJSON(ctx, "/api/v1/tunnel/apply-log", payload, &resp); err != nil {
 		return err
 	}
-	return apiError(resp.ErrorMsg)
+	return edgehttp.APIError(resp.ErrorMsg)
 }
 
 func (c *Client) SetToken(token string) {
-	c.token = strings.TrimSpace(token)
-	slog.Debug("http client token updated")
-}
-
-func (c *Client) getJSON(ctx context.Context, path string, target any) error {
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, c.baseURL+path, nil)
-	if err != nil {
-		return err
-	}
-	req.Header.Set("X-Tunnel-Token", c.token)
-	return c.do(req, target)
-}
-
-func (c *Client) postJSON(ctx context.Context, path string, body any, target any) error {
-	data, err := json.Marshal(body)
-	if err != nil {
-		return err
-	}
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, c.baseURL+path, bytes.NewReader(data))
-	if err != nil {
-		return err
-	}
-	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("X-Tunnel-Token", c.token)
-	return c.do(req, target)
-}
-
-func (c *Client) do(req *http.Request, target any) error {
-	res, err := c.httpClient.Do(req)
-	if err != nil {
-		slog.Error("http request failed", "method", req.Method, "path", req.URL.Path, "error", err)
-		return err
-	}
-	defer func(Body io.ReadCloser) {
-		err := Body.Close()
-		if err != nil {
-			slog.Error("failed to close response body", "error", err)
-		}
-	}(res.Body)
-
-	body, err := io.ReadAll(res.Body)
-	if err != nil {
-		slog.Error("http response read failed", "method", req.Method, "path", req.URL.Path, "error", err)
-		return err
-	}
-	if res.StatusCode != http.StatusOK {
-		slog.Warn("http request returned non-200", "method", req.Method, "path", req.URL.Path, "status", res.Status)
-		return readBodyError(body, res.Status)
-	}
-	if target == nil {
-		return nil
-	}
-	if err = json.Unmarshal(body, target); err != nil {
-		slog.Error("http response decode failed", "method", req.Method, "path", req.URL.Path, "error", err)
-		return err
-	}
-	return nil
-}
-
-func apiError(msg string) error {
-	if strings.TrimSpace(msg) == "" {
-		return nil
-	}
-	return errors.New(msg)
-}
-
-func readBodyError(body []byte, fallback string) error {
-	var errBody struct {
-		ErrorMsg string `json:"error_msg"`
-	}
-	if err := json.Unmarshal(body, &errBody); err == nil && strings.TrimSpace(errBody.ErrorMsg) != "" {
-		return errors.New(errBody.ErrorMsg)
-	}
-	return errors.New(fallback)
-}
+	c.base.SetToken(token)
+}

internal/apps/flared/updater/restart_unix.go

@@ -1,51 +0,0 @@
-//go:build !windows
-
-package updater
-
-import (
-	"fmt"
-	"log/slog"
-	"os"
-	"syscall"
-)
-
-func replaceAndRestart(execPath string, tmpPath string) error {
-	backupPath := execPath + ".bak"
-	if err := removeBackupBinary(backupPath); err != nil {
-		return err
-	}
-	if err := os.Rename(execPath, backupPath); err != nil {
-		renameErr := err
-		if err := os.Remove(tmpPath); err != nil && !os.IsNotExist(err) {
-			slog.Error("remove tmp binary failed", "path", tmpPath, "error", err)
-			return fmt.Errorf("backup current binary: %w; remove tmp binary: %v", renameErr, err)
-		}
-		return fmt.Errorf("backup current binary: %w", renameErr)
-	}
-	if err := os.Rename(tmpPath, execPath); err != nil {
-		replaceErr := err
-		if err := os.Rename(backupPath, execPath); err != nil {
-			slog.Error("restore backup binary failed", "path", backupPath, "error", err)
-			return fmt.Errorf("replace binary: %w; restore backup binary: %v", replaceErr, err)
-		}
-		return fmt.Errorf("replace binary: %w", replaceErr)
-	}
-	if err := removeBackupBinary(backupPath); err != nil {
-		return err
-	}
-	if err := syscall.Exec(execPath, os.Args, os.Environ()); err != nil {
-		return fmt.Errorf("exec restart: %w", err)
-	}
-	return fmt.Errorf("unreachable after exec")
-}
-
-func removeBackupBinary(path string) error {
-	if err := os.Remove(path); err != nil {
-		if os.IsNotExist(err) {
-			return nil
-		}
-		slog.Error("remove backup binary failed", "path", path, "error", err)
-		return err
-	}
-	return nil
-}

internal/apps/flared/updater/restart_windows.go

@@ -1,53 +0,0 @@
-//go:build windows
-
-package updater
-
-import (
-	"fmt"
-	"os"
-	"os/exec"
-	"strings"
-)
-
-func replaceAndRestart(execPath string, tmpPath string) error {
-	backupPath := execPath + ".bak"
-	scriptPath := execPath + ".update.cmd"
-	script := fmt.Sprintf(`@echo off
-setlocal
-:waitloop
-move /Y "%s" "%s" >nul 2>nul
-if errorlevel 1 (
-  ping 127.0.0.1 -n 2 >nul
-  goto waitloop
-)
-move /Y "%s" "%s" >nul 2>nul
-if errorlevel 1 exit /b 1
-start "" %s
-del /Q "%s" >nul 2>nul
-del /Q "%%~f0" >nul 2>nul
-`, execPath, backupPath, tmpPath, execPath, buildWindowsCommandLine(execPath, os.Args[1:]), backupPath)
-	if err := os.WriteFile(scriptPath, []byte(script), 0o700); err != nil {
-		os.Remove(tmpPath)
-		return fmt.Errorf("write restart script: %w", err)
-	}
-	cmd := exec.Command("cmd", "/C", "start", "", scriptPath)
-	if err := cmd.Start(); err != nil {
-		os.Remove(scriptPath)
-		os.Remove(tmpPath)
-		return fmt.Errorf("schedule restart: %w", err)
-	}
-	os.Exit(0)
-	return nil
-}
-
-func buildWindowsCommandLine(execPath string, args []string) string {
-	parts := []string{quoteWindowsArg(execPath)}
-	for _, arg := range args {
-		parts = append(parts, quoteWindowsArg(arg))
-	}
-	return strings.Join(parts, " ")
-}
-
-func quoteWindowsArg(value string) string {
-	return `"` + strings.ReplaceAll(value, `"`, `""`) + `"`
-}

internal/apps/flared/updater/updater.go

@@ -1,371 +1,17 @@
 package updater
 
 import (
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"fmt"
-	"io"
-	"log/slog"
-	"net/http"
-	"os"
-	"runtime"
-	"strings"
-	"time"
-
-	"github.com/Rain-kl/Wavelet/pkg/utils"
-
+	edgeupdater "github.com/Rain-kl/Wavelet/internal/apps/edge/updater"
 	"github.com/Rain-kl/Wavelet/internal/apps/flared/config"
 )
 
-const maxChecksumAssetSize = 64 * 1024
-
-var replaceAndRestartFunc = replaceAndRestart
-
-type Service struct {
-	httpClient   *http.Client
-	lastCheckKey string
-}
+type Service = edgeupdater.Service
+type UpdateOptions = edgeupdater.UpdateOptions
 
 func New() *Service {
-	return &Service{
-		httpClient: &http.Client{Timeout: 30 * time.Second},
-	}
-}
-
-type githubRelease struct {
-	TagName    string        `json:"tag_name"`
-	Prerelease bool          `json:"prerelease"`
-	Draft      bool          `json:"draft"`
-	Assets     []githubAsset `json:"assets"`
-}
-
-type githubAsset struct {
-	Name               string `json:"name"`
-	BrowserDownloadURL string `json:"browser_download_url"`
-}
-
-type UpdateOptions struct {
-	Channel string
-	TagName string
-	Force   bool
-}
-
-func (s *Service) CheckAndUpdate(ctx context.Context, repo string, options UpdateOptions) error {
-	release, err := s.getRelease(ctx, repo, options)
-	if err != nil {
-		return fmt.Errorf("check latest release: %w", err)
-	}
-	if release == nil || release.TagName == "" {
-		return nil
-	}
-
-	remoteVersion := normalizeVersion(release.TagName)
-	localVersion := normalizeVersion(config.Version)
-	checkKey := buildReleaseCheckKey(options, remoteVersion)
-
-	if remoteVersion == localVersion {
-		return nil
-	}
-	if !options.Force && checkKey != "" && checkKey == s.lastCheckKey {
-		return nil
-	}
-	if !isNewer(localVersion, remoteVersion) {
-		s.lastCheckKey = checkKey
-		return nil
-	}
-
-	slog.Info("flared update available", "from", localVersion, "to", remoteVersion)
-	assetName := assetNameForGOOSGOARCH(runtime.GOOS, runtime.GOARCH)
-	checksumAssetName := assetName + ".sha256"
-
-	var downloadURL string
-	var checksumURL string
-	for _, asset := range release.Assets {
-		switch asset.Name {
-		case assetName:
-			downloadURL = asset.BrowserDownloadURL
-		case checksumAssetName:
-			checksumURL = asset.BrowserDownloadURL
-		}
-	}
-	if downloadURL == "" {
-		s.lastCheckKey = checkKey
-		return fmt.Errorf("no matching asset %q in release %s", assetName, release.TagName)
-	}
-	if checksumURL == "" {
-		return fmt.Errorf("no matching checksum asset %q in release %s", checksumAssetName, release.TagName)
-	}
-
-	expectedChecksum, err := s.downloadChecksum(ctx, checksumURL, assetName)
-	if err != nil {
-		return fmt.Errorf("download checksum: %w", err)
-	}
-
-	execPath, err := os.Executable()
-	if err != nil {
-		return fmt.Errorf("get executable path: %w", err)
-	}
-	if err = s.downloadAndRestart(ctx, downloadURL, expectedChecksum, execPath); err != nil {
-		return fmt.Errorf("download and restart: %w", err)
-	}
-	s.lastCheckKey = checkKey
-	return nil
-}
-
-func (s *Service) getRelease(ctx context.Context, repo string, options UpdateOptions) (*githubRelease, error) {
-	tagName := strings.TrimSpace(options.TagName)
-	if tagName != "" {
-		return s.getReleaseByTag(ctx, repo, tagName)
-	}
-	if strings.EqualFold(strings.TrimSpace(options.Channel), "preview") {
-		return s.getLatestPreviewRelease(ctx, repo)
-	}
-	return s.getLatestStableRelease(ctx, repo)
-}
-
-func (s *Service) getLatestStableRelease(ctx context.Context, repo string) (*githubRelease, error) {
-	url := fmt.Sprintf("https://api.github.com/repos/%s/releases/latest", repo)
-	return s.fetchReleaseFromURL(ctx, url)
-}
-
-func (s *Service) getLatestPreviewRelease(ctx context.Context, repo string) (*githubRelease, error) {
-	url := fmt.Sprintf("https://api.github.com/repos/%s/releases?per_page=20", repo)
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
-	if err != nil {
-		return nil, err
-	}
-	req.Header.Set("Accept", "application/vnd.github+json")
-
-	resp, err := s.httpClient.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("github api returned %s", resp.Status)
-	}
-
-	var releases []githubRelease
-	if err = json.NewDecoder(resp.Body).Decode(&releases); err != nil {
-		return nil, err
-	}
-	for _, release := range releases {
-		if release.Draft || !release.Prerelease {
-			continue
-		}
-		releaseCopy := release
-		return &releaseCopy, nil
-	}
-	return nil, nil
-}
-
-func (s *Service) getReleaseByTag(ctx context.Context, repo string, tag string) (*githubRelease, error) {
-	url := fmt.Sprintf("https://api.github.com/repos/%s/releases/tags/%s", repo, strings.TrimSpace(tag))
-	return s.fetchReleaseFromURL(ctx, url)
-}
-
-func (s *Service) fetchReleaseFromURL(ctx context.Context, url string) (*githubRelease, error) {
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
-	if err != nil {
-		return nil, err
-	}
-	req.Header.Set("Accept", "application/vnd.github+json")
-
-	resp, err := s.httpClient.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	defer func(Body io.ReadCloser) {
-		err := Body.Close()
-		if err != nil {
-			slog.Error("failed to close response body", "error", err)
-		}
-	}(resp.Body)
-
-	if resp.StatusCode == http.StatusNotFound {
-		return nil, nil
-	}
-	if resp.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("github api returned %s", resp.Status)
-	}
-
-	return decodeRelease(resp.Body)
-}
-
-func decodeRelease(reader io.Reader) (*githubRelease, error) {
-	var release githubRelease
-	if err := json.NewDecoder(reader).Decode(&release); err != nil {
-		return nil, err
-	}
-	return &release, nil
-}
-
-func (s *Service) downloadChecksum(ctx context.Context, url string, assetName string) (string, error) {
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
-	if err != nil {
-		return "", err
-	}
-	resp, err := s.httpClient.Do(req)
-	if err != nil {
-		return "", err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return "", fmt.Errorf("checksum download returned %s", resp.Status)
-	}
-
-	content, err := io.ReadAll(io.LimitReader(resp.Body, maxChecksumAssetSize+1))
-	if err != nil {
-		return "", err
-	}
-	if len(content) > maxChecksumAssetSize {
-		return "", fmt.Errorf("checksum asset exceeds %d bytes", maxChecksumAssetSize)
-	}
-	checksum, err := parseSHA256Checksum(string(content), assetName)
-	if err != nil {
-		return "", err
-	}
-	return checksum, nil
-}
-
-func parseSHA256Checksum(content string, assetName string) (string, error) {
-	assetName = strings.TrimSpace(assetName)
-	for _, line := range strings.Split(content, "\n") {
-		line = strings.TrimSpace(line)
-		if line == "" || strings.HasPrefix(line, "#") {
-			continue
-		}
-		if checksum, ok := parseSHA256Line(line, assetName); ok {
-			return checksum, nil
-		}
-	}
-	if assetName == "" {
-		return "", fmt.Errorf("checksum asset does not contain a valid sha256 digest")
-	}
-	return "", fmt.Errorf("checksum asset does not contain a sha256 digest for %q", assetName)
-}
-
-func parseSHA256Line(line string, assetName string) (string, bool) {
-	fields := strings.Fields(line)
-	if len(fields) == 1 && isSHA256Hex(fields[0]) {
-		return strings.ToLower(fields[0]), true
-	}
-	if len(fields) >= 2 && isSHA256Hex(fields[0]) {
-		fileName := strings.TrimPrefix(strings.TrimSpace(fields[1]), "*")
-		if assetName == "" || fileName == assetName {
-			return strings.ToLower(fields[0]), true
-		}
-	}
-
-	prefix := "SHA256("
-	if strings.HasPrefix(line, prefix) {
-		closing := strings.Index(line, ")")
-		if closing > len(prefix) && closing+1 < len(line) {
-			fileName := strings.TrimSpace(line[len(prefix):closing])
-			rest := strings.TrimSpace(line[closing+1:])
-			rest = strings.TrimPrefix(rest, "=")
-			rest = strings.TrimSpace(rest)
-			if isSHA256Hex(rest) && (assetName == "" || fileName == assetName) {
-				return strings.ToLower(rest), true
-			}
-		}
-	}
-	return "", false
-}
-
-func isSHA256Hex(value string) bool {
-	value = strings.TrimSpace(value)
-	if len(value) != sha256.Size*2 {
-		return false
-	}
-	_, err := hex.DecodeString(value)
-	return err == nil
-}
-
-func (s *Service) downloadAndRestart(ctx context.Context, url string, expectedChecksum string, targetPath string) error {
-	expectedChecksum = strings.ToLower(strings.TrimSpace(expectedChecksum))
-	if !isSHA256Hex(expectedChecksum) {
-		return fmt.Errorf("invalid expected sha256 checksum")
-	}
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
-	if err != nil {
-		return err
-	}
-	resp, err := s.httpClient.Do(req)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("download returned %s", resp.Status)
-	}
-
-	tmpPath := targetPath + ".update"
-	if runtime.GOOS == "windows" && !strings.HasSuffix(strings.ToLower(tmpPath), ".exe") {
-		tmpPath += ".exe"
-	}
-	tmpFile, err := os.OpenFile(tmpPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o600)
-	if err != nil {
-		return err
-	}
-	hasher := sha256.New()
-	if _, err = io.Copy(io.MultiWriter(tmpFile, hasher), resp.Body); err != nil {
-		tmpFile.Close()
-		os.Remove(tmpPath)
-		return err
-	}
-	if err = tmpFile.Close(); err != nil {
-		os.Remove(tmpPath)
-		return err
-	}
-	actualChecksum := hex.EncodeToString(hasher.Sum(nil))
-	if actualChecksum != expectedChecksum {
-		os.Remove(tmpPath)
-		return fmt.Errorf("sha256 checksum mismatch: expected %s, got %s", expectedChecksum, actualChecksum)
-	}
-	if err = os.Chmod(tmpPath, 0o755); err != nil && runtime.GOOS != "windows" {
-		os.Remove(tmpPath)
-		return fmt.Errorf("set executable permission: %w", err)
-	}
-
-	slog.Info("flared binary updated, restarting")
-	return replaceAndRestartFunc(targetPath, tmpPath)
-}
-
-func assetNameForGOOSGOARCH(goos string, goarch string) string {
-	name := fmt.Sprintf("openflared-%s-%s", goos, goarch)
-	if goos == "windows" {
-		return name + ".exe"
-	}
-	return name
-}
-
-func normalizeVersion(v string) string {
-	v = strings.TrimSpace(v)
-	v = strings.TrimPrefix(v, "v")
-	return v
-}
-
-func isNewer(local, remote string) bool {
-	return compareVersions(local, remote) < 0
-}
-
-func buildReleaseCheckKey(options UpdateOptions, remoteVersion string) string {
-	channel := strings.TrimSpace(options.Channel)
-	if channel == "" {
-		channel = "stable"
-	}
-	if tagName := strings.TrimSpace(options.TagName); tagName != "" {
-		return channel + ":" + tagName
-	}
-	return channel + ":" + remoteVersion
-}
-
-func compareVersions(local string, remote string) int {
-	return utils.CompareVersions(local, remote)
-}
+	return edgeupdater.New(edgeupdater.Config{
+		LocalVersion: config.Version,
+		AssetPrefix:  "openflared",
+		LogLabel:     "flared",
+	})
+}