Function resolve_operator_at 

async fn resolve_operator_at(
    client: &Client,
    document_url: &str,
    operator_did: &str,
    private: PrivateAddresses,
) -> Result<(DidDocument, String, Client), ClaimFetchError>

resolve_operator from document_url onward.

The endpoint the document names is checked against didbot_http::REFUSED_BLOCKS before anything fetches from it. The operator’s DID is configuration, but the #atproto_pds endpoint inside their document is not: it is a URL this server is told to fetch from by a document it just read, which is the same kind of URL a client_id is.