project build fails before first deploy when a gateway target references a project credential

Start with the agentcore project build entry point and the generated CDK application's credential resolution, then compare it with the deploy path that provisions credentials first. Add the requested regression test for a fresh project with an OAuth credential and MCP gateway target, and verify that build or synthesis succeeds before deployment.

Summary

agentcore project build cannot synthesize a new project when a gateway target references an OAuth credential declared in the same project before the first deployment.

agentcore project deploy works around this by provisioning credentials before it builds, but the standalone build command does not. This makes an otherwise valid project impossible to build in CI or inspect with CDK synthesis before its first deploy.

Reproduction

In a new project, add a gateway and then run:

printf '%s' "$CLIENT_SECRET" | agentcore project add credentials oauth \
  --name MyOauthCredential \
  --vendor CustomOauth2 \
  --client-id my-client \
  --discovery-url https://auth.example.com/.well-known/openid-configuration \
  --client-secret -

agentcore project add gateway-target \
  --gateway MyGateway \
  --name MyMCPTarget \
  --endpoint https://my-mcp-server.example.com \
  --outbound-auth oauth \
  --credential-name MyOauthCredential

agentcore project build

Actual behavior

CDK synthesis fails:

AgentCore CDK synthesis failed: Credential "MyOauthCredential" not found in deployed state

The generated CDK application resolves the target's credential reference only from .cli/deployed-state.json. That state cannot contain the credential before the first deployment.

The deploy path provisions credentials before calling build, so agentcore project deploy does not expose the same failure.

Expected behavior

A project whose resources reference other resources declared in the same project should synthesize before its first deployment. project build should not require deployed state for an in-project credential reference.

Suggested direction

Represent credential references symbolically during synthesis, or make the generated CDK application resolve credentials declared in the project without requiring deployed state. If this cannot be supported, project build should produce a targeted error and the project workflow should explicitly model the required credential provisioning phase.

Please add a regression test for a fresh project containing an OAuth credential and an MCP gateway target that references it.