refactor: tried to split the db package more, but there are too many dependencies to do it properly right now

internal/services/keys/BUILD.bazel

@@ -19,6 +19,7 @@ go_library(
     visibility = ["//:__subpackages__"],
     deps = [
         "//internal/services/caches",
+        "//internal/services/keys/db",
         "//internal/services/keys/metrics",
         "//internal/services/ratelimit",
         "//internal/services/usagelimiter",
@@ -28,10 +29,10 @@ go_library(
         "//pkg/clickhouse",
         "//pkg/clickhouse/schema",
         "//pkg/codes",
-        "//pkg/db",
         "//pkg/fault",
         "//pkg/hash",
         "//pkg/logger",
+        "//pkg/mysql",
         "//pkg/otel/tracing",
         "//pkg/ptr",
         "//pkg/rbac",

internal/services/keys/db/BUILD.bazel

@@ -0,0 +1,23 @@
+load("@rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "db",
+    srcs = [
+        "cached_key_data.go",
+        "database.go",
+        "doc.go",
+        "generate.go",
+        "key_find_credits.sql_generated.go",
+        "key_find_for_verification.sql_generated.go",
+        "key_find_for_verification_ratelimits.go",
+        "key_migration_find_by_id.sql_generated.go",
+        "key_update_credits_decrement.sql_generated.go",
+        "key_update_hash_and_migration.sql_generated.go",
+        "models_generated.go",
+        "querier_generated.go",
+        "quota_find_by_workspace_id.sql_generated.go",
+    ],
+    importpath = "github.com/unkeyed/unkey/internal/services/keys/db",
+    visibility = ["//visibility:public"],
+    deps = ["//pkg/mysql"],
+)

internal/services/keys/db/cached_key_data.go

@@ -0,0 +1,8 @@
+package db
+
+// CachedKeyData embeds FindKeyForVerificationRow and adds pre-processed data for caching.
+// This struct is stored in the cache to avoid redundant parsing operations.
+type CachedKeyData struct {
+	FindKeyForVerificationRow
+	ParsedIPWhitelist map[string]struct{} // Pre-parsed IP addresses for O(1) lookup
+}

internal/services/keys/db/database.go

@@ -0,0 +1,34 @@
+package db
+
+import (
+	"context"
+	"database/sql"
+
+	"github.com/unkeyed/unkey/pkg/mysql"
+)
+
+// DBTX is the database interface required by generated query methods. It mirrors
+// the subset of [database/sql.DB] and [database/sql.Tx] that sqlc-generated code
+// calls, so either a plain connection or a transaction satisfies it.
+type DBTX interface {
+	ExecContext(context.Context, string, ...interface{}) (sql.Result, error)
+	PrepareContext(context.Context, string) (*sql.Stmt, error)
+	QueryContext(context.Context, string, ...interface{}) (*sql.Rows, error)
+	QueryRowContext(context.Context, string, ...interface{}) *sql.Row
+}
+
+type Queries struct{}
+
+var Query Querier = &Queries{}
+
+type Database = mysql.Database
+type Config = mysql.Config
+
+var (
+	IsNotFound = mysql.IsNotFound
+)
+
+func New(config Config) (mysql.Database, error) {
+	return mysql.New(config)
+
+}

internal/services/keys/db/doc.go

@@ -0,0 +1,22 @@
+// Package db provides read-only database access for the frontline reverse proxy.
+//
+// Frontline resolves incoming requests to deployment targets by looking up routes,
+// certificates, and sentinel endpoints. All queries are read-only because frontline
+// never mutates routing or certificate state; other services own those writes.
+//
+// The package uses sqlc to generate type-safe query methods from SQL files in the
+// queries/ subdirectory. Hand-written code in database.go provides the [New]
+// constructor that connects to a MySQL read replica with tracing and metrics.
+//
+// # Key Types
+//
+// [Querier] is the generated interface listing all available queries. [New] returns
+// a [Querier] backed by a read replica connection. Callers use the returned close
+// function to release the underlying connection pool.
+//
+// # Code Generation
+//
+// Run `go generate ./...` from this directory to regenerate query code. The generate
+// pipeline clears old *_generated.go files, runs sqlc, and removes the temporary
+// db scaffold file that sqlc emits (see generate.go and sqlc.json for details).
+package db

internal/services/keys/db/generate.go

@@ -0,0 +1,16 @@
+package db
+
+// Generation pipeline for sqlc query code.
+//
+// Step 1: remove stale *_generated.go files so renamed or deleted queries
+//         do not leave orphan code behind.
+//go:generate rm -rf ./*_generated.go || true
+
+// Step 2: run sqlc, which reads sqlc.json, parses queries/, and emits
+//         typed Go code plus a scaffold db file named "deleteme.go".
+//go:generate go tool sqlc generate
+
+// Step 3: delete deleteme.go because database.go already provides the
+//         [DBTX] interface, [Queries] struct, and [New] constructor that
+//         sqlc would otherwise generate with no replica or metrics support.
+//go:generate rm ./deleteme.go