@props([
    'action',
    'label' => null,
    'confirm' => null,
])

{{--
    Deletion always goes through a POST form with a method spoof and an explicit
    confirmation. A destructive action reachable by a GET link is one prefetching
    browser extension away from deleting a patient record.
--}}
<form method="POST" action="{{ $action }}" class="d-inline"
      data-clinic-confirm="{{ $confirm ?? __('common.confirm_delete') }}">
    @csrf
    @method('DELETE')
    {{-- px, not Bootstrap: this button renders inside px panels on almost every
         screen in the product — patient records, rotas, user accounts — so an
         outline-danger here was the one Bootstrap control left sitting among
         them. --}}
    <button type="submit" {{ $attributes->merge(['class' => 'btn btn-sm px-btn-danger-ghost']) }}>
        <i class="bi bi-trash"></i>
        <span>{{ $label ?? __('common.delete') }}</span>
    </button>
</form>