From f28804862bd2dd70a2739c8334757bb4629f8ef9 Mon Sep 17 00:00:00 2001
From: martbost <martybostick@gmail.com>
Date: Sat, 19 Sep 2026 16:41:25 -0500
Subject: [PATCH] Training: two NAS zones (above the first video, above the
 Circle Method); CSP allows the NAS script and https images

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 public/training.html | 2 ++
 server.js            | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/public/training.html b/public/training.html
index 6e4feb6..6eb6ac9 100644
--- a/public/training.html
+++ b/public/training.html
@@ -8,6 +8,7 @@
 <main>
 <section class="section"><div class="wrap"><div class="section-head"><div class="eyebrow">Team training</div><h1 style="font-size:clamp(34px,5vw,54px);margin:8px 0 10px">Watch. Learn. <span class="gold">Duplicate.</span></h1><p>Short videos take you from zero to your Premium position — in order. Watch them all before you join, and share this page with your two directs when it's their turn.</p></div>
 
+<div class="nas-zone" style="max-width:728px;margin:18px auto 26px;overflow:hidden;text-align:center"><!-- nas-training --><script src="https://www.networkadspace.com/showadss.php?w=728&h=90&n=1&bw=728&bh=90&c=999"></script></div>
 <div class="video-card" style="max-width:880px;margin:0 auto 26px"><div style="padding:6px 6px 0"><div class="eyebrow">Video 1 · 5 min · UPDATED</div><h2 style="margin:6px 0 6px">How the team build works</h2><p style="color:var(--muted);margin:0 0 12px">The full picture in five minutes: the 2-direct strategy, both income streams, the catch-or-pass rule, spillover, the moving link, and how your dashboard coaches you through all of it.</p></div><video class="video-frame" style="display:block;width:100%;height:auto;aspect-ratio:16/9" controls preload="metadata" poster="/v/rmc-team-overview-poster.jpg" src="/v/rmc-team-overview-f8856dc743.mp4"><track kind="captions" srclang="en" label="English" src="/captions/rmc-team-overview-f8856dc743.en.vtt"><track kind="captions" srclang="it" label="Italiano" src="/captions/rmc-team-overview-f8856dc743.it.vtt"><track kind="captions" srclang="fr" label="Français" src="/captions/rmc-team-overview-f8856dc743.fr.vtt"><track kind="captions" srclang="es" label="Español" src="/captions/rmc-team-overview-f8856dc743.es.vtt"><track kind="captions" srclang="de" label="Deutsch" src="/captions/rmc-team-overview-f8856dc743.de.vtt"><track kind="captions" srclang="pt" label="Português" src="/captions/rmc-team-overview-f8856dc743.pt.vtt"></video></div>
 
 <div class="video-card" style="max-width:880px;margin:0 auto 26px"><div style="padding:6px 6px 0"><div class="eyebrow">Video 2 · 3 min</div><h2 style="margin:6px 0 6px">Create your MetaMask wallet</h2><p style="color:var(--muted);margin:0 0 12px">Install MetaMask safely and set up your wallet. Never share your Secret Recovery Phrase with anyone.</p></div><video class="video-frame" style="display:block;width:100%;height:auto;aspect-ratio:16/9" controls preload="metadata" poster="/training/create_metamask_wallet_poster.jpg" src="/training/create_metamask_wallet.mp4"></video></div>
@@ -45,6 +46,7 @@
   </div>
 </a>
 
+<div class="nas-zone" style="max-width:728px;margin:18px auto 26px;overflow:hidden;text-align:center"><!-- nas-training-2 --><script src="https://www.networkadspace.com/showadss.php?w=728&h=90&n=1&bw=728&bh=90&c=999"></script></div>
 <h2 id="circle-method" style="max-width:880px;margin:44px auto 6px;font-size:30px">⭕ The Circle Method — Module 1: Get Your Two</h2>
 <p style="max-width:880px;margin:0 auto 20px;color:var(--muted)">Our recruiting course, taught by the team. Four short lessons that take you from "I could never recruit" to your first two curious people — the honest way: no pitching, no pressure, no income promises. Watch them in order, then run the plays. When your two join, send them these same lessons — that's the Method.</p>
 <img src="/v/rmc-napkin.jpg" alt="The Circle Method sketched on a napkin: get your 2, help your 2 get theirs, teach them to do the same" style="display:block;max-width:880px;width:100%;margin:0 auto 26px;border-radius:16px;border:1px solid #23425d">
diff --git a/server.js b/server.js
index fd81911..ce460d7 100644
--- a/server.js
+++ b/server.js
@@ -578,7 +578,7 @@ async function handleTranslate(req,res){
 
 // frame-src includes 'self' so our own pages (the Page Builder preview framing
 // a member's /p/<id> page) are not blocked by our own policy.
-const CSP_BASE="default-src 'self'; script-src 'self' https://polhunter.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; media-src 'self' https://coolify-saasytop.nyc3.digitaloceanspaces.com; connect-src 'self' https://polhunter.com; font-src 'self' data:; form-action 'self'; frame-src 'self' https://www.youtube-nocookie.com"; // polhunter.com: the PolHunter embed on /training (2026-09-19)
+const CSP_BASE="default-src 'self'; script-src 'self' https://polhunter.com https://www.networkadspace.com https://networkadspace.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; media-src 'self' https://coolify-saasytop.nyc3.digitaloceanspaces.com; connect-src 'self' https://polhunter.com; font-src 'self' data:; form-action 'self'; frame-src 'self' https://www.youtube-nocookie.com"; // polhunter.com: the PolHunter embed on /training (2026-09-19)
 function securityHeaders(extra={}) {
   // Public pages must render inside safelist / traffic-exchange iframes, so framing stays open here; admin.html re-locks it via ADMIN_FRAME_HEADERS.
   return {