Terraform plan visualizer

The engine reads resource_changes only: output_changes, prior_state, and the configuration block are ignored, and the Plan line arithmetic replicates Terraform's own (a replacement counts once as an add and once as a destroy). Risk flags are review heuristics, not a safety verdict: data-holding comes from the resource type name (database, bucket, disk, volume, key, secret), security flags come from attribute names like ingress, cidr, or policy, and open-world flags an after value of 0.0.0.0/0 or ::/0. Sensitive values are masked at the source, so they never reach the screen or any export.