/**
 * CDTO enrollment shell — design tokens (волна R2).
 * Маркер: enroll-ux-uniform-r1r3r10-20260730
 * Канон A1: карточка 36×26rem, mint фон, единые pad/gap/radius.
 */
:root {
  --cdto-enroll-card-max-w: 36rem;
  --cdto-enroll-card-min-h: 26rem;
  --cdto-enroll-card-pad-y: 2rem;
  --cdto-enroll-card-pad-x: 1.5rem;
  --cdto-enroll-card-gap: 0.85rem;
  --cdto-enroll-card-radius: 0.5rem;
  --cdto-enroll-title-size: 1.5rem;
  --cdto-enroll-title-weight: 700;
  --cdto-enroll-title-color: #151515;
  --cdto-enroll-sub-color: #475569;
  --cdto-enroll-sub-size: 0.9375rem;
  --cdto-enroll-bg: #ecfdf5;
  --cdto-space-menu-h: 53px;
  /* Эталон «Вход»/step1 @1280×900: меню→карточка ≈146px */
  --cdto-idp-card-gap-top: 146px;
}

/* Enroll-path карточка ожидания — всегда токены A1 (не 22rem base). */
html.cdto-telegraf-oauth-callback .cdto-auth-wait-card,
html.cdto-telegraf-enroll-settle .cdto-auth-wait-card,
html.cdto-enroll-post-confirm-handoff .cdto-auth-wait-card,
html.cdto-enroll-in-card-wait .cdto-auth-wait-card,
body.cdto-enroll-shell .cdto-auth-wait-card,
#cdto-session-reset-auth-wait .cdto-auth-wait-card,
.mas-telegraf-cdto-card--enroll-shell,
.cdto-enroll-shell-card {
  box-sizing: border-box !important;
  width: min(var(--cdto-enroll-card-max-w), calc(100vw - 2rem)) !important;
  max-width: var(--cdto-enroll-card-max-w) !important;
  min-height: var(--cdto-enroll-card-min-h) !important;
  height: var(--cdto-enroll-card-min-h) !important;
  max-height: var(--cdto-enroll-card-min-h) !important;
  overflow: hidden !important;
  padding: var(--cdto-enroll-card-pad-y) var(--cdto-enroll-card-pad-x) !important;
  gap: var(--cdto-enroll-card-gap) !important;
  border-radius: var(--cdto-enroll-card-radius) !important;
}

html.cdto-telegraf-oauth-callback .cdto-auth-wait-title,
html.cdto-telegraf-enroll-settle .cdto-auth-wait-title,
html.cdto-enroll-post-confirm-handoff .cdto-auth-wait-title,
#cdto-session-reset-auth-wait .cdto-auth-wait-title {
  font-size: var(--cdto-enroll-title-size) !important;
  font-weight: var(--cdto-enroll-title-weight) !important;
  color: var(--cdto-enroll-title-color) !important;
}

html.cdto-telegraf-oauth-callback .cdto-auth-wait-long,
html.cdto-telegraf-enroll-settle .cdto-auth-wait-long,
html.cdto-enroll-post-confirm-handoff .cdto-auth-wait-long,
#cdto-session-reset-auth-wait .cdto-auth-wait-long {
  color: var(--cdto-enroll-sub-color) !important;
  font-size: var(--cdto-enroll-sub-size) !important;
}

/* R3: под P1 handoff не показывать challenge P0 (двойной title). */
html.cdto-enroll-post-confirm-handoff ak-flow-executor::part(challenge),
html.cdto-enroll-post-confirm-handoff [data-cdto-p0-title="1"],
html.cdto-enroll-post-confirm-handoff [data-cdto-p0-sub="1"],
html.cdto-enroll-post-confirm-handoff .pf-c-login__main-header,
html.cdto-enroll-post-confirm-handoff .pf-c-login__main-body > form,
html.cdto-enroll-post-confirm-handoff .pf-c-form__group.pf-m-action {
  visibility: hidden !important;
  pointer-events: none !important;
}