In direct mode (alg: ECDH-ES) the derived key is the content encryption key and the JWE's encrypted-key part is empty; in the wrapped modes (ECDH-ES+A128KW, +A192KW, +A256KW) it wraps a random CEK, which allows several recipients. The header carries the ephemeral public key epk and optional apu and apv (party information) that enter the KDF together with the algorithm name and key length (§4.6.2). P-256, P-384, P-521 and, via RFC 8037, X25519 and X448 are allowed.
Recipients must validate epk: in 2017 several JOSE libraries accepted points off the curve, letting an attacker recover the recipient's private key through invalid-curve queries (RFC 8725 §2.5). ECDH-ES gives the recipient no proof of who sent the message; sign first (nested JWT) when that matters. HPKE (RFC 9180) is the modern generalization, and JOSE work is underway to use it.