supabase-js upsert and PostgreSQL ON CONFLICT idempotency for retried inserts

Goal is to make retried HTTP inserts from supabase-js safe against duplicate writes when PostgREST is used as the data API over PostgreSQL.

The integration boundary has no transport-level idempotency. Idempotency is expected to be modeled in the database via a client-supplied key with a unique constraint and an upsert that maps to INSERT ... ON CONFLICT. The onConflict columns must match a unique or exclusion constraint, and ignoreDuplicates influences whether a conflict is surfaced as an error or as an empty result. Row Level Security applies to conflict paths, and database side effects such as triggers or webhooks may still execute on each attempt.

What is the defined response contract for supabase-js upsert when a conflict is ignored? How should a caller differentiate a benign duplicate skip from a genuine failure when no rows are returned? Does RLS evaluation differ on the conflict path versus a normal insert?