# XWUIPageView Renders one piece of content whose *format is data*, not code: Markdown, HTML, a JSON form schema, a registered JSON DSL, or runnable JavaScript/TypeScript. The page decides what it is showing at runtime, which is what makes it the right component for content a product stores rather than compiles - documentation pages, CMS bodies, plugin panels, AI-generated snippets. The interesting part is the trust boundary. Runnable content (`js`, `ts`, and untrusted `html`) is **sandboxed by default**, not because a flag was set but because that is the default value of `config.execution`. ## When to use - Content whose format is only known at runtime, or is chosen by an author. - Any surface that renders code or markup the first party did not write: user-generated, plugin-supplied, or model-generated. - Documentation and in-product help, where Markdown and a live example sit in the same pipeline. Reach for `XWUIMarkdown` when the content is always Markdown, and for `XWUIScriptEditor` when the user is editing code rather than viewing its result. ## Content and trust lanes `data.source` is the renderable unit: `format` plus one of `source` (inline text), `value` (a pre-parsed object for `json-form` / `json`) or `src` (a URL to fetch). `format: 'json'` also takes `dsl`, the registered DSL key that renders it. New formats are added by registering a renderer, so the built-in union is a starting set, not a ceiling. `config.execution` picks the lane for runnable content: - `sandboxed` - **the default**. An `