Function resolve_repo 

pub(crate) fn resolve_repo(
    state: &AppState,
    repo: &str,
) -> Result<String, ApiError>

Resolves the repo parameter, which is an at-identifier.

A DID or a handle, because that is what every com.atproto.repo.* lexicon says the field is. Resolving it here rather than inside the registry means the handle-to-DID step happens once, in the layer that already owns /.well-known/atproto-did, and every route below works in DIDs.

The returned DID is the stored one, never the string the caller sent, so an at:// URI built from it names the repository the same way twice however the caller spelled it.

A DID goes through canonical_did first, for the local-only trap leaves behind: a development DID carries a percent-encoded port, a query value is percent-decoded once before a handler sees it, and a person who copied did:web:kestrel.agents.localhost%3A4211 out of a log and pasted it into a URL would otherwise get a 404 for a repository that is plainly there. The query service performs the same repair, from the same function.