Hi, I'm currently working on Tink for JavaScript. (Formerly as part of a rotation on Google's cryptography team; that rotation has ended so I'm now doing this on weekends.)
Tink for JavaScript is being used in production systems internally at Google, but the open source release isn't fully baked yet. npm compatibility is a big part of that; our internal codebase doesn't use npm, but we absolutely want open source users to be able to install and use Tink from npm without installing Bazel (though Bazel will most likely continue to be required in order to contribute to Tink). This is why JavaScript is not currently listed among the production-ready languages. Right now I'm fixing it by migrating the codebase to TypeScript so that it can use the TypeScript Bazel rules, which facilitate compatibility with npm.
The biggest complicating factor here is that Tink, like many Google software projects, internally uses Protocol Buffers to serialize data (primarily keys) in a way that's compatible across all the different languages that it supports. Protocol Buffers work really nicely with Bazel and significantly less nicely with most other build systems. Again, though, Bazel won't be required in order to depend on the package, only to build it from source.
