Constant ENCODED_COLON 

const ENCODED_COLON: &str = "%3A";

The only percent escape an atproto did:web may contain: the colon that separates a bare loopback hostname from its port. Uppercase hex only, because the spec says “DIDs are case-sensitive” and implementations “should reject DIDs with invalid casing” — one spelling keeps comparison a byte compare.

Nothing here mints a DID carrying one. A zone’s accounts answer on 443, so their DIDs name a hostname and nothing else; this is read, not written, so a DID somebody else minted still parses.