couldn't you just embed the js directly into the html file though? that would sidestep the CORS error. and since most of the people using a program like this are likely to be using AI to generate their ( likely throwaway ) applets anyway, readability and maintainability for the source doesn't matter as much as it would with human authors so having a separate js file doesn't bring that many advantages anyway.