Sorry for the wrong term. :(
What would be a correct term for all that HTTP headers security stuff?
"Security headers"? "Cross-Origin headers"?

What I'm trying to say is that if those HTTP headers are not configured correctly, worker currently has no way to find out the PyScript version it's running at. It could only guess by the Pyodide version.

correct, it cannot do that unless the sync mechanism exposes something that could or could not be awaited, which is cumbersome ... I have no answer right now except this should be provided by our build step, everything else seems to be meh to me.

What would be a correct term for all that HTTP headers security stuff?

it's literally COEP or specifically COI (as in: Cross-Origin-Isolation), see https://developer.mozilla.org/en-US/docs/Web/API/Window/crossOriginIsolated

the TL;DR of this story is that SharedArrayBuffer was a lovely missing piece of the Web that got instantly blocked by Meltdown and Spectre attacks, the paranoia is that malicious 3rd party scripts could read private data stored in memory through that interface (it's complicated but possible) so either everything is considered secure or browsers refuse to give the JS runtime such primitive.

WASM is a different story: it inevitably needs SharedArrayBuffer in there but also it's something one explicitly download with privileges (CORS in this case, for projects coming from CDNs such as Pyodide or MicroPython) so it's a trusted execution as it's still local and cannot access remote sites memory, only the one the WASM declares and uses.

Because SharedArrayBuffer cannot travel via postMessage or other APIs when cross origin isolation is not available, there is literally no way to circumvent the requirements around these headers, but people don't know such headers and trust too much anything they inject on regular Web pages 🤷

We have various workarounds that already serve us well for both static websites (Service Worker mini-coi) or even via blocking HXMLHttpRequest hack, but Safari chokes with latter approach because it rate-limits itself (don't make me start this ... 🤦)

P.S. the Web is a security paranoia environment by design ... we are already doing everything possible to help people understand and use all its features but we can't do the impossible, the browser still decides what's OK and what's not, I am afraid.

this should be provided by our build step, everything else seems to be meh to me

Well, yep.

And thanks once again for explaining JS/Browser stuff to me.