Index: src/middleware/render.js
===================================================================
--- src/middleware/render.js	(revision e2ea5c49d99947fd02bdda292a25027f868b7225)
+++ src/middleware/render.js	(revision c6185fa8bf0039de95fa1be9afb9804d70c203af)
@@ -27,5 +27,5 @@
 // partials. HTML-escaped "<script" in rendered content (e.g. sanitized post bodies) won't
 // match, so this only touches real tags.
-function injectCspNonce(html, nonce) {
+export function injectCspNonce(html, nonce) {
   if (!html || !nonce) return html;
   return String(html).replace(/<script(?![^>]*\snonce=)/gi, () => `<script nonce="${nonce}"`);