from collections.abc import AsyncIterator, Iterator
 from dataclasses import replace
 from datetime import UTC, datetime
+from typing import Literal, NamedTuple, TypeGuard

-_CLOUD_PROVIDER_TARGET_KEYS: dict[str, tuple[tuple[str, str], ...]] = {
+CloudProviderSlug = Literal["bedrock", "azure_openai", "azure_ai", "vertex_ai"]
+
+
+class CloudTargetKey(NamedTuple):
+    metadata_key: str
+    credential_key: str
+
+
+_CLOUD_PROVIDER_TARGET_KEYS: dict[CloudProviderSlug, tuple[CloudTargetKey, ...]] = {
     "bedrock": (
-        ("inference_profile_id", "AWS_INFERENCE_PROFILE_ID"),
-        ("model_id", "AWS_MODEL_ID"),
+        CloudTargetKey("inference_profile_id", "AWS_INFERENCE_PROFILE_ID"),
+        CloudTargetKey("model_id", "AWS_MODEL_ID"),
     ),
-    "azure_openai": (("deployment_name", "AZURE_DEPLOYMENT_NAME"),),
-    "azure_ai": (("azure_ai_model_name", "AZURE_AI_MODEL_NAME"),),
-    "vertex_ai": (("vertex_model", "VERTEX_AI_MODEL"),),
+    "azure_openai": (CloudTargetKey("deployment_name", "AZURE_DEPLOYMENT_NAME"),),
+    "azure_ai": (CloudTargetKey("azure_ai_model_name", "AZURE_AI_MODEL_NAME"),),
+    "vertex_ai": (CloudTargetKey("vertex_model", "VERTEX_AI_MODEL"),),
 }


+def _is_cloud_provider(slug: str) -> TypeGuard[CloudProviderSlug]:
+    return slug in _CLOUD_PROVIDER_TARGET_KEYS
+
+
     def _catalog_target_credentials(self, row: AgentCatalog) -> dict[str, str]:
         """Project cloud catalog target metadata into runtime credential keys."""
-        target_keys = _CLOUD_PROVIDER_TARGET_KEYS.get(row.model_provider)
-        if not target_keys:
+        if not _is_cloud_provider(row.model_provider):
             return {}
+        target_keys = _CLOUD_PROVIDER_TARGET_KEYS[row.model_provider]
         metadata = row.model_metadata if isinstance(row.model_metadata, dict) else {}
         credentials: dict[str, str] = {}
-        for metadata_key, credential_key in target_keys:
-            value = metadata.get(metadata_key)
+        for spec in target_keys:
+            value = metadata.get(spec.metadata_key)
             if isinstance(value, str) and value:
-                credentials[credential_key] = value
+                credentials[spec.credential_key] = value
         return credentials

     def _catalog_encrypted_target_credentials(
         self,
         row: AgentCatalog,
     ) -> dict[str, str]:
         """Decrypt migrated catalog config for cloud target keys only."""
-        target_keys = _CLOUD_PROVIDER_TARGET_KEYS.get(row.model_provider)
-        if not target_keys or row.encrypted_config is None:
+        if not _is_cloud_provider(row.model_provider) or row.encrypted_config is None:
             return {}
-        allowed_keys = {credential_key for _, credential_key in target_keys}
+        target_keys = _CLOUD_PROVIDER_TARGET_KEYS[row.model_provider]
+        allowed_keys = {spec.credential_key for spec in target_keys}