What does a Package URL (PURL) identify?

Why this is the answer

PURL is an identifier, not a locator: pkg:npm/lodash@4.17.21 names the same package no matter which tool reads it, which is what makes cross-tool matching possible. It deliberately is not a download URL — the ecosystem type implies where it lives. A CVE or GHSA id names a vulnerability, not a package. Build job identity belongs to provenance metadata.