Update project settings (current values appear at the top of list_files). Keys: title (2-100 chars), description, iconUrl (the app's icon/logo: favicon, home-screen icon and native app icon — a /_cdn/static/… path from upload_asset, generate_image or request_user_upload, or an absolute https URL; null resets), splashUrl (native splash screen, same value forms), mobileAppId, enableSSR (boolean), flootAiDisallowed (boolean — true opts the project out of @floot/ai), and iOS Info.plist purpose strings (NS…UsageDescription — set to a string, or null to remove) plus boolean Info.plist keys (UIViewControllerBasedStatusBarAppearance — set to a boolean, or null to restore the template default). Invalid keys/values are reported and skipped. NOTE: these take effect on the published app only after the next publish (publish_app, or the user's Publish button). The iosInfoPlist keys only affect builds made before the first iOS publish; after the iOS app is published, edit the project file `static/__dev/native/ios-info.plist` directly with write_file/edit_file (see get_guides('ios-info-plist')). Likewise, after the first Android publish, edit `static/__dev/native/android-manifest.xml` directly for manifest changes (see get_guides('android-manifest')). `shareTarget` makes the native app appear in the iOS and Android share sheets (other apps can share photos/videos/files/text into it): pass { enabled: true, mimeTypes?, allowMultiple? } to register, { enabled: false } to remove; receiving the shared items still needs the handler in app code — read get_guides('share-target') first and ship both together. `nativeSystemBars` controls how the native app treats the status bar / Android navigation bar: mode 'inset' (default) keeps the app below the bars and paints the exposed strips `color` (default black — set it to the app's header color for a seamless look); mode 'edge-to-edge' runs the app under the bars, which REQUIRES the app to pad by var(--safe-area-inset-top/bottom) itself — read get_guides('native-system-bars') first and ship both changes together. Not superseded by the __dev/native files. `serverMemoryMb` sets the memory (MB) of the project's server Lambda, which runs every endpoint, queued task, scheduled job and SSR render (default 1024 MB; 2048 for the published app when SSR is on — the dev backend never bumps). EXPERT SETTING — NEVER change it on your own initiative or as a side effect of another request, only when the user explicitly asks to change the server memory AND understands the trade-off: too low and the backend stops working entirely (killed out-of-memory); Lambda CPU scales with memory, so a lower value also makes every request slower and — because compute is billed per GB-second of billed duration — can cost MORE, not less; a higher value costs more per millisecond. Allowed range 512–4096 MB, whole MB (if a size turns out not to be available for the app's server, the deploy fails and the error names this setting). It applies to the dev backend at the next backend deploy and to the published app at the next publish. Pass null to restore the default. Read get_guides('server-memory') before changing it. `analyticsMode` controls the built-in visitor analytics tracker every published app includes (the project's Analytics tab): 'storage' (default) keeps a 30-minute session id in the visitor's localStorage, which is device storage that needs consent under EU ePrivacy / UK PECR — an app with EU/UK visitors pairs it with a consent banner that calls window.flootAnalytics.setMode(); 'memory' keeps the id in memory only (nothing stored on the device, no consent needed, but a reload or new tab counts as a new session); 'off' sends no analytics at all. Only change it when the user asks about analytics, cookies, consent or privacy for their published app; it takes effect at the next publish. Read get_guides('analytics') for the consent-banner API before changing it. `iosDeviceFamily` picks the devices the native iOS app is built for: 'iphone-and-ipad' (default, universal) or 'iphone' (iPhone only — the app still installs on iPads but runs there in iPhone compatibility mode, and App Store Connect no longer asks for iPad screenshots). This is the ONLY way to make the app iPhone-only: it is an Xcode build setting, so a UIDeviceFamily key in static/__dev/native/ios-info.plist is overwritten at build and does nothing. One-way door: App Store Connect rejects an update that drops iPad once a version supporting iPad has been released on the App Store, and the build then fails at upload. Before setting 'iphone', ask the user whether the app is already live on the App Store; if it is, tell them it cannot be made iPhone-only and do not set it. Takes effect at the next iOS publish. `routePrefetch` controls how the PUBLISHED app downloads other pages' code ahead of navigation: mode 'auto' (default: every page when the app has 15 or fewer, else links entering the screen plus hover/touch), 'all', 'viewport' (links in view + hover/touch), 'intent' (hover/touch only) or 'off'; skipAutomation: true turns warming off in automated browsers (navigator.webdriver: Playwright, Puppeteer, Selenium). A single link opts out with the attribute data-no-prefetch on the <a> or an ancestor (honoured in every mode except the whole-app warm of 'all' / small-app 'auto'). Only change it when the user asks about page prefetching or load performance; it takes effect at the next publish. `dependencyOverrides` forces the version of a package one of the project's dependencies pulls in, in the PUBLISHED app's installs (pnpm overrides), for when a dependency pins a vulnerable package and has no fixed release: { "exceljs>uuid": "11.1.1" } moves the uuid that exceljs uses. Keys are always "parent>package" and the parent must be one of the project's own dependencies (an entry whose parent is not is kept but not applied); a value of null removes that entry, and null for the whole parameter removes them all. Versions are exact or ^/~ on an exact version. Prefer the fixed release on the major the parent asks for (or the nearest one): a newer major can break the parent, and the published backend runs Node 22 without require() of ES modules, so an ESM-only major breaks a CommonJS parent. Packages Floot manages (React, the router, zod, the default UI packages, build tooling, @tiptap/*, Capacitor, sharp, hono…) are refused as parent or package. Adding the fixed version as a direct dependency does NOT change a nested copy; this does. It applies to the published app at the next publish, and to the preview from the next change (reload the preview). Only set it when the user asks to fix a dependency vulnerability or version conflict. `securityHeaders` sets the published app's own page headers: `embedding` (who may show the app in an iframe: 'anyone' (default), 'self', 'none', or a list of https origins), `csp` (directive -> the COMPLETE source list for it, replacing the platform's; other directives keep the platform's), `cspReportOnly` (try `csp` without enforcing it) and `referrerPolicy`. Each field passed replaces the stored one and null removes it (inside `csp`, per directive); `securityHeaders: null` restores the platform defaults. Changes that would break the app are refused with the reason. Change it only when the user asks about embedding / iframes / clickjacking, a security scan finding, a stricter or looser Content-Security-Policy, or referrer privacy; it takes effect at the next publish and never in the preview. Read get_guides('security-headers') before changing it.