Declare upper bound for package:js

This is critical, and ensures this doesn't break for users because package:js API is different.