Implement `GET /orders` with optional status filtering, a documented newest-first order, and a stable continuation cursor.

• Clamp page size to 1 through 100.
• Use a deterministic tie-breaker.
• Project before materialization.
• Do not pass arbitrary sort strings into dynamic SQL.

I parse the cursor into the exact ordering tuple, apply the same tuple to the WHERE boundary, fetch one extra row, and emit a next cursor only when another page exists.

app.MapGet("/orders", async Task<Results<Ok<OrderPage>, ValidationProblem>>
    (string? status, int? take, string? cursor, AppDbContext db, CancellationToken ct) =>
{
    OrderStatus? parsedStatus = null;
    if (status is not null) {
        if (!Enum.TryParse<OrderStatus>(status, true, out var value) ||
            !Enum.IsDefined(value))
            return TypedResults.ValidationProblem(new() {
                ["status"] = ["Status must be open, paid, or cancelled."]
            });
        parsedStatus = value;
    }
    if (!OrderCursor.TryDecode(cursor, out var after))
        return TypedResults.ValidationProblem(new() {
            ["cursor"] = ["Cursor is invalid."]
        });

    var size = Math.Clamp(take ?? 25, 1, 100);
    var query = db.Orders.AsNoTracking();
    if (parsedStatus is not null)
        query = query.Where(x => x.Status == parsedStatus.Value);
    if (after is not null)
        query = query.Where(x => x.CreatedAt < after.CreatedAt ||
            (x.CreatedAt == after.CreatedAt && x.Id.CompareTo(after.Id) < 0));

    var rows = await query
        .OrderByDescending(x => x.CreatedAt).ThenByDescending(x => x.Id)
        .Select(x => new OrderListItem(x.Id, x.Number, x.Status, x.CreatedAt))
        .Take(size + 1).ToListAsync(ct);

    var hasMore = rows.Count > size;
    var items = rows.Take(size).ToArray();
    var next = hasMore ? OrderCursor.Encode(items[^1].CreatedAt, items[^1].Id) : null;
    return TypedResults.Ok(new OrderPage(items, next));
});

The query cost is bounded by page size and supported indexes. The cursor is opaque to clients but must be versioned or rejected cleanly if its format changes.

• No rows match.
• Several rows share a timestamp.
• The cursor row was deleted.
• A caller requests zero or one million rows.

• Walk every page and assert no duplicates.
• Insert timestamp ties.
• Reject a malformed cursor before EF runs.

• Offset paging a rapidly changing list.
• Ordering without a unique tie-breaker.
• Materializing before projection.
• Accepting arbitrary column names.