@@ -597,87 +597,100 @@ function exportKeyPkcs8(key) {
 }
 
 function exportKeyRawPublic(key, format) {
+  let exporter;
+  let exportFormat = kWebCryptoKeyFormatRaw;
   switch (getCryptoKeyAlgorithm(key).name) {
     case 'ECDSA':
       // Fall through
     case 'ECDH':
-      return require('internal/crypto/ec')
-        .ecExportKey(key, kWebCryptoKeyFormatRaw);
+      exporter = require('internal/crypto/ec').ecExportKey;
+      break;
     case 'Ed25519':
       // Fall through
     case 'Ed448':
       // Fall through
     case 'X25519':
       // Fall through
     case 'X448':
-      return require('internal/crypto/cfrg')
-        .cfrgExportKey(key, kWebCryptoKeyFormatRaw);
+      exporter = require('internal/crypto/cfrg').cfrgExportKey;
+      break;
     case 'ML-DSA-44':
       // Fall through
     case 'ML-DSA-65':
       // Fall through
-    case 'ML-DSA-87': {
+    case 'ML-DSA-87':
       // ML-DSA keys don't recognize "raw"
       if (format !== 'raw-public') {
         return undefined;
       }
-      return require('internal/crypto/ml_dsa')
-        .mlDsaExportKey(key, kWebCryptoKeyFormatRaw);
-    }
+      exporter = require('internal/crypto/ml_dsa').mlDsaExportKey;
+      break;
     case 'ML-KEM-512':
       // Fall through
     case 'ML-KEM-768':
       // Fall through
-    case 'ML-KEM-1024': {
+    case 'ML-KEM-1024':
       // ML-KEM keys don't recognize "raw"
       if (format !== 'raw-public') {
         return undefined;
       }
-      return require('internal/crypto/ml_kem')
-        .mlKemExportKey(key, kWebCryptoKeyFormatRaw);
-    }
+      exporter = require('internal/crypto/ml_kem').mlKemExportKey;
+      break;
     case 'MLKEM768-P256':
       // Fall through
     case 'MLKEM768-X25519':
       // Fall through
-    case 'MLKEM1024-P384': {
+    case 'MLKEM1024-P384':
       if (format !== 'raw-public') {
         return undefined;
       }
-      return require('internal/crypto/kem_hybrids')
-        .kemHybridExportKey(key, format);
-    }
+      exporter = require('internal/crypto/kem_hybrids').kemHybridExportKey;
+      exportFormat = format;
+      break;
     default:
       return undefined;
   }
+
+  if (getCryptoKeyType(key) !== 'public')
+    throw lazyDOMException('Key must be a public key', 'InvalidAccessError');
+
+  return exporter(key, exportFormat);
 }
 
 function exportKeyRawSeed(key) {
+  let exporter;
+  let exportFormat = kWebCryptoKeyFormatRaw;
   switch (getCryptoKeyAlgorithm(key).name) {
     case 'ML-DSA-44':
       // Fall through
     case 'ML-DSA-65':
       // Fall through
     case 'ML-DSA-87':
-      return require('internal/crypto/ml_dsa')
-        .mlDsaExportKey(key, kWebCryptoKeyFormatRaw);
+      exporter = require('internal/crypto/ml_dsa').mlDsaExportKey;
+      break;
     case 'ML-KEM-512':
       // Fall through
     case 'ML-KEM-768':
       // Fall through
     case 'ML-KEM-1024':
-      return require('internal/crypto/ml_kem')
-        .mlKemExportKey(key, kWebCryptoKeyFormatRaw);
+      exporter = require('internal/crypto/ml_kem').mlKemExportKey;
+      break;
     case 'MLKEM768-P256':
       // Fall through
     case 'MLKEM768-X25519':
       // Fall through
     case 'MLKEM1024-P384':
-      return require('internal/crypto/kem_hybrids')
-        .kemHybridExportKey(key, 'raw-seed');
+      exporter = require('internal/crypto/kem_hybrids').kemHybridExportKey;
+      exportFormat = 'raw-seed';
+      break;
     default:
       return undefined;
   }
+
+  if (getCryptoKeyType(key) !== 'private')
+    throw lazyDOMException('Key must be a private key', 'InvalidAccessError');
+
+  return exporter(key, exportFormat);
 }
 
 function exportKeyRawSecret(key, format) {
@@ -847,21 +860,17 @@ function exportKeySync(format, key) {
       break;
     }
     case 'raw-public': {
-      if (type === 'public') {
-        result = exportKeyRawPublic(key, format);
-      }
+      result = exportKeyRawPublic(key, format);
       break;
     }
     case 'raw-seed': {
-      if (type === 'private') {
-        result = exportKeyRawSeed(key);
-      }
+      result = exportKeyRawSeed(key);
       break;
     }
     case 'raw': {
       if (type === 'secret') {
         result = exportKeyRawSecret(key, format);
-      } else if (type === 'public') {
+      } else {
         result = exportKeyRawPublic(key, format);
       }
       break;
 
@@ -172,6 +172,14 @@ async function testImportPkcs8({ name, privateUsages }, extractable) {
     assert.strictEqual(
       Buffer.from(pkcs8).toString('hex'),
       keyData[name].pkcs8.toString('hex'));
+
+    for (const format of ['raw', 'raw-public']) {
+      await assert.rejects(
+        subtle.exportKey(format, key), {
+          message: 'Key must be a public key',
+          name: 'InvalidAccessError',
+        });
+    }
   } else {
     await assert.rejects(
       subtle.exportKey('pkcs8', key), {
 
@@ -175,6 +175,14 @@ async function testImportPkcs8(
         message: 'Key must be a public key',
         name: 'InvalidAccessError',
       });
+
+    for (const format of ['raw', 'raw-public']) {
+      await assert.rejects(
+        subtle.exportKey(format, key), {
+          message: 'Key must be a public key',
+          name: 'InvalidAccessError',
+        });
+    }
   } else {
     await assert.rejects(
       subtle.exportKey('pkcs8', key), {
 
@@ -414,6 +414,11 @@ async function testImportRawPublic({ name, publicUsages }, extractable) {
       name: 'NotSupportedError',
       message: `Unable to export ${publicKey.algorithm.name} public key using raw format`,
     });
+
+    await assert.rejects(subtle.exportKey('raw-seed', publicKey), {
+      name: 'InvalidAccessError',
+      message: 'Key must be a private key',
+    });
   }
 
   await assert.rejects(
@@ -453,6 +458,11 @@ async function testImportRawSeed({ name, privateUsages }, extractable) {
   if (extractable) {
     const value = await subtle.exportKey('raw-seed', privateKey);
     assert.deepStrictEqual(Buffer.from(value), seed);
+
+    await assert.rejects(subtle.exportKey('raw-public', privateKey), {
+      name: 'InvalidAccessError',
+      message: 'Key must be a public key',
+    });
   }
 
   await assert.rejects(
 
@@ -237,6 +237,11 @@ async function testImportRawPublic({ name, publicUsages }, extractable) {
       name: 'NotSupportedError',
       message: `Unable to export ${publicKey.algorithm.name} public key using raw format`,
     });
+
+    await assert.rejects(subtle.exportKey('raw-seed', publicKey), {
+      name: 'InvalidAccessError',
+      message: 'Key must be a private key',
+    });
   }
 
   await assert.rejects(
@@ -276,6 +281,11 @@ async function testImportRawSeed({ name, privateUsages }, extractable) {
   if (extractable) {
     const value = await subtle.exportKey('raw-seed', privateKey);
     assert.deepStrictEqual(Buffer.from(value), seed);
+
+    await assert.rejects(subtle.exportKey('raw-public', privateKey), {
+      name: 'InvalidAccessError',
+      message: 'Key must be a public key',
+    });
   }
 
   await assert.rejects(
 
@@ -587,6 +587,16 @@ async function testNonByteLengthWrapUnwrap({
       name: 'InvalidAccessError',
     });
 
+  // Exporting a private key as 'raw' must also fail with InvalidAccessError.
+  await assert.rejects(
+    subtle.wrapKey('raw', ecKey.privateKey, wrapKey, {
+      name: 'AES-GCM',
+      iv: new Uint8Array(12),
+    }), {
+      message: 'Key must be a public key',
+      name: 'InvalidAccessError',
+    });
+
   // --- unwrapKey validation tests ---
 
   const ciphertext = new Uint8Array(32); // Dummy ciphertext