{{--
    Row actions for the Projects DataTable — docs/wireframes-v12/project-management.html:

        <div class="action-group">
          <a class="btn-icon" title="View"><i class="fa-solid fa-eye"></i></a>
          <a class="btn-icon" title="Edit"><i class="fa-solid fa-pen"></i></a>
        </div>

    v12 shows view + edit. Delete is added here because the module has a delete
    permission and no other screen exposes it; it wears the same `.btn-icon`
    with the wireframe's own `.text-danger` utility, which is the colouring
    v12 gives a destructive icon button elsewhere (`.btn-icon-sm.text-danger`).

    Rendered by ProjectsDataTable through rawColumns(['actions']), which means
    this output is injected into the page unescaped. Nothing user-controlled
    may reach it unescaped: the project name only appears inside @js(), which
    emits it as a JSON string literal with < > & " escaped to \u sequences.

    yajra hands the row's model in as $model.

    Every control is gated on its own ability rather than on one blanket check,
    so an Operations user (projects.view only) gets the eye and nothing else.

    Delete is a real POST form with a confirm() guard, not a link: a GET that
    destroys data would be triggered by any crawler or prefetch. The confirm is
    the wireframe-free option the plan calls for — no modal, no new JS.
--}}
@php
    /** @var \App\Models\Project $model */
@endphp
<div class="action-group">
    @can('view', $model)
        <a href="{{ route('projects.show', $model) }}"
           class="btn-icon"
           title="{{ __('projects.actions.view') }}"
           aria-label="{{ __('projects.actions.view') }}">
            <i class="fa-solid fa-eye" aria-hidden="true"></i>
        </a>
    @endcan

    @can('update', $model)
        <a href="{{ route('projects.edit', $model) }}"
           class="btn-icon"
           title="{{ __('projects.actions.edit') }}"
           aria-label="{{ __('projects.actions.edit') }}">
            <i class="fa-solid fa-pen" aria-hidden="true"></i>
        </a>
    @endcan

    @can('delete', $model)
        {{-- CR-16 item J2: a plain button, not a form with a confirm().
             `data-url` is the destroy route rendered by route() — the client's
             own instruction — and `data-confirm` is the SAME lang sentence the
             confirm() showed, which the shared dialog writes with textContent.
             nrems-ajax-delete.js sends the DELETE and redraws this table in
             place, so the page and the filters survive the delete. --}}
        <button type="button"
                class="btn-icon text-danger"
                data-role="ajax-delete"
                data-id="{{ $model->getKey() }}"
                data-url="{{ route('projects.destroy', $model) }}"
                data-confirm="{{ __('projects.delete_confirm', ['name' => $model->name]) }}"
                title="{{ __('projects.actions.delete') }}"
                aria-label="{{ __('projects.actions.delete') }}">
            <i class="fa-solid fa-trash" aria-hidden="true"></i>
        </button>
    @endcan
</div>