From 138db218f7f4c98e67ff9ef382cc2d1d2ae07cd8 Mon Sep 17 00:00:00 2001
From: BathreeNode <101283333+batuhankocyigit@users.noreply.github.com>
Date: Sat, 5 Sep 2026 11:41:35 +0300
Subject: [PATCH 1/4] Improve error message for unsupported algorithm

---
 packages/jwt/src/signer.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/jwt/src/signer.ts b/packages/jwt/src/signer.ts
index bf617920..727d984e 100644
--- a/packages/jwt/src/signer.ts
+++ b/packages/jwt/src/signer.ts
@@ -22,6 +22,6 @@ export function createJwtSigner(keypair: Keypair): JwtSigner {
     case "Ed25519":
       return EdDSASigner(keypair.privateKey)
     default:
-      throw new Error("Unsupported algorithm", keypair.curve)
+      throw new Error(`Unsupported algorithm: ${String(keypair.curve)}`)
   }
 }

From 2211cb8c49594fac294bc5adb02539c317e63552 Mon Sep 17 00:00:00 2001
From: BathreeNode <101283333+batuhankocyigit@users.noreply.github.com>
Date: Sat, 5 Sep 2026 11:44:54 +0300
Subject: [PATCH 2/4] Add test for unsupported curve error in JWT signer

---
 packages/jwt/src/signer.test.ts | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/packages/jwt/src/signer.test.ts b/packages/jwt/src/signer.test.ts
index 9a47cf62..cc8d7023 100644
--- a/packages/jwt/src/signer.test.ts
+++ b/packages/jwt/src/signer.test.ts
@@ -1,6 +1,5 @@
 import { generateKeypair } from "@agentcommercekit/keys"
 import { describe, expect, test } from "vitest"
-
 import { createJwtSigner } from "./signer"
 
 describe("createJwtSigner", () => {
@@ -68,6 +67,24 @@ describe("createJwtSigner", () => {
     expect(signature1).not.toBe(signature2)
   })
 
+  test("throws a descriptive error for an unsupported curve", async () => {
+    const keypair = await generateKeypair("secp256k1")
+    // Simulate a Keypair with an invalid/unsupported curve, e.g. one that
+    // arrived from untrusted or future data and was never runtime-validated.
+    const invalidKeypair = {
+      ...keypair,
+      curve: "invalid-curve",
+    }
+    // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- intentionally passing invalid input to exercise runtime validation
+    const signerInput = invalidKeypair as unknown as Parameters
+      typeof createJwtSigner
+    >[0]
+
+    expect(() => createJwtSigner(signerInput)).toThrow(
+      "Unsupported algorithm: invalid-curve",
+    )
+  })
+
   test("handles both string and Uint8Array input", async () => {
     const keypair = await generateKeypair("secp256k1")
     const signer = createJwtSigner(keypair)

From 815803285e5ec2828af677dabb0bfeb758003a11 Mon Sep 17 00:00:00 2001
From: BathreeNode <101283333+batuhankocyigit@users.noreply.github.com>
Date: Sat, 5 Sep 2026 11:46:01 +0300
Subject: [PATCH 3/4] Improve error reporting for unsupported algorithm in
 createJwtSigner

The error message now includes the unsupported curve name for better debugging.
---
 .changeset/fix-signer-unsupported-algorithm-error.md | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 create mode 100644 .changeset/fix-signer-unsupported-algorithm-error.md

diff --git a/.changeset/fix-signer-unsupported-algorithm-error.md b/.changeset/fix-signer-unsupported-algorithm-error.md
new file mode 100644
index 00000000..3ee5dbf2
--- /dev/null
+++ b/.changeset/fix-signer-unsupported-algorithm-error.md
@@ -0,0 +1,12 @@
+---
+"@agentcommercekit/jwt": patch
+---
+
+`createJwtSigner` now reports which curve it could not handle.
+
+The `default` branch called `new Error("Unsupported algorithm", keypair.curve)`.
+`Error`'s second argument is an `ErrorOptions` object (`{ cause }`), not a
+message part, so passing a string there is silently dropped at runtime and
+fails to type-check under `strict` TypeScript. The curve is now interpolated
+into the message instead, so the thrown error actually names the unsupported
+curve.

From 0c4ca0a6b44a114d2c6edb8d4f571d7371b8d792 Mon Sep 17 00:00:00 2001
From: BathreeNode <101283333+batuhankocyigit@users.noreply.github.com>
Date: Mon, 7 Sep 2026 10:36:35 +0300
Subject: [PATCH 4/4] Fix type assertion for invalid keypair in tests

---
 packages/jwt/src/signer.test.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/jwt/src/signer.test.ts b/packages/jwt/src/signer.test.ts
index cc8d7023..6d16a0a2 100644
--- a/packages/jwt/src/signer.test.ts
+++ b/packages/jwt/src/signer.test.ts
@@ -76,7 +76,7 @@ describe("createJwtSigner", () => {
       curve: "invalid-curve",
     }
     // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- intentionally passing invalid input to exercise runtime validation
-    const signerInput = invalidKeypair as unknown as Parameters
+    const signerInput = invalidKeypair as unknown as Parameters<
       typeof createJwtSigner
     >[0]