fix: cdk import fails with "modified resources ... not being imported" when a stack has unordered dependencies

packages/@aws-cdk/cloudformation-diff/lib/diff-template.ts

@@ -51,8 +51,12 @@ export function fullDiff(
   changeSet?: DescribeChangeSetOutput,
   isImport?: boolean,
 ): types.TemplateDiff {
-  normalize(currentTemplate);
-  normalize(newTemplate);
+  // AFTER — work on clones, originals stay untouched
+  const currentCopy = structuredClone(currentTemplate);
+  const newCopy     = structuredClone(newTemplate);
+  normalize(currentCopy);
+  normalize(newCopy);
+  // use currentCopy / newCopy everywhere below instead
   const theDiff = diffTemplate(currentTemplate, newTemplate);
   if (changeSet) {
     // These methods mutate the state of theDiff, using the changeSet.

packages/@aws-cdk/toolkit-lib/lib/api/resource-import/importer.ts

@@ -296,27 +296,23 @@ export class ResourceImporter {
    */
   private async currentTemplate(): Promise<any> {
     if (!this._currentTemplate) {
-      this._currentTemplate = await this.cfn.readCurrentTemplate(this.stack);
+      this._currentTemplate = Object.freeze(structuredClone(await this.cfn.readCurrentTemplate(this.stack)));
     }
     return this._currentTemplate;
   }
-
   /**
    * Return the current template, with the given resources added to it
    */
   private async currentTemplateWithAdditions(additions: ImportableResource[]): Promise<any> {
-    const template = await this.currentTemplate();
+    const template = structuredClone(await this.currentTemplate());
     if (!template.Resources) {
       template.Resources = {};
     }
-
     for (const add of additions) {
       template.Resources[add.logicalId] = add.resourceDefinition;
     }
-
     return template;
   }
-
   /**
    * Get a list of import identifiers for all resource types used in the given
    * template that do support the import operation (SINGLETON)