Crack the Safe

Build "Crack the Safe" — a polished mobile-first portrait web app for the Eazo community.

CONCEPT
A magnificent bank vault fills the screen with a brass combination dial. Rotate it slowly with your finger: at hidden positions the dial trembles almost imperceptibly and emits a visual "click" pulse — pass three correct stops in sequence and the vault swings open onto its treasure (which escalates from a single delicious sandwich to increasingly absurd national treasures). Ten vaults, each with subtler clicks and longer combinations. Pure fingertip ASMR rendered visually.

RULES & STATES
- Open with a 1.5-second teaser of vault ten swinging open in golden light, melting into vault one’s humble door.
- Dial rotation with inertia; click feedback is a visual pulse + micro-shake whose intensity fades with each vault tier.
- Wrong stops past tolerance reset the current combination with a disappointed clunk; a stethoscope hint mode (hold center) amplifies pulses for 3 seconds, twice per vault.
- Result card: "Master Thief Résumé" — vaults cracked, total dial rotations, sharpest ear rating, and the strangest treasure liberated.

OPENING
No cover page: open with a roughly 1.5-second finished-result teaser that melts into the empty play state, then the player begins. The title stays as a small chip; one gesture hint dissolves on first touch. Keep gentle ambient motion afterwards.

GLOBAL REQUIREMENTS
- Language: ship a lightweight built-in i18n layer with exactly two locales, English (en) and Chinese (zh). The app ALWAYS opens in English — never auto-detect or follow the system/browser language. Provide one small, comfortably tappable EN / 中文 toggle placed top-right, about 56px down from the top edge, clear of the device status bar. Chinese appears only after the user actively switches. All share output stays English regardless of locale. Never mix two languages on one screen.
- Fully self-contained: absolutely no external APIs of any kind — no AI calls, no third-party data, media or font services, no remote backend, no login. Embed all data and content in the app code.
- Real Share to the Eazo Community: on the result screen add a real Share button. Compose the result card as an image on a canvas and share it through the Eazo SDK community share (share.compose with the image attachment plus a short English text). Read the resolved { accepted } value: only when accepted is true may the button say "Sent to Eazo"; when accepted is false the button must read "Open in the Eazo app to share"; on error keep the original button. Never claim the post was shared on the plain web. Keep a Replay button next to Share.
- Mobile-first portrait, touch-only, no hover dependence. The app root must follow the host container height (position: fixed; inset: 0; height: 100%) — never 100dvh or 100svh. Size any canvas from its PARENT element using a ResizeObserver (run the fit once on mount), and convert every touch event through getBoundingClientRect() read at event time — never cache the rect and never use window.innerWidth/innerHeight for canvas sizing.
- Safe areas: keep all top UI at least 56px from the top edge. Keep every core interactive control (start button, submit, share, play controls) fully above the bottom 88px of the viewport — the Eazo mobile app overlays a native toolbar there that your code cannot detect.
- No background music and no autoplay audio.
- Complete real states: loading, empty, success, error where relevant. Every control must actually work — no alerts, console-log placeholders or fake results.
- Visual bar: rich, generous visual feedback on every touch (motion, particles, deformation, color, light) while keeping exactly ONE core rule understood within 3 seconds. Canvas 2D preferred for effects; do not use the canvas roundRect API (older iOS Safari lacks it). Never hardcode light text colors onto possibly-light backgrounds — derive text color from the theme.