Function select_capabilities 

pub fn select_capabilities<'a>(
    kit: &'a [KitCapability],
    sources: &str,
    config: &Table,
    requested: &BTreeMap<String, bool>,
    opaque: bool,
) -> Result<Vec<&'a KitCapability>, String>

The capabilities a package of one app carries, out of the ones a kit offers.

requested is the app’s [capabilities] table, and an entry there settles that capability outright. Every other one follows its own rule against sources, the app’s markup, scripts, styles and config read into one haystack, and config, the app’s parsed lumen.toml. opaque says the app runs code the scan cannot read (a C++ or Python program driving the engine), so every use rule answers yes and only the table, a request-only rule, or a config rule leaves a capability out. A requested name the kit does not carry is an error naming what it does, so a misspelling is caught rather than ignored.