Update logic should not combine with install, since the ApplicationService should provide the update method when updating from remote using the update protocol, otherwise, it may be a security hole. Install & Update are not exactly the same, the code can be shared may be these parts:

1. Extract the XPK and construct the ApplicationData object
2. Register Events & Permissions