Bun install --frozen-lockfile does not lock optional dependencies

When using Bun's --frozen-lockfile flag, the lockfile guarantees that direct and transitive dependencies are installed at the exact versions recorded in bun.lockb. However, the flag does not constrain how Bun handles optional dependencies listed in package.json. Depending on the target platform and the package’s optionalDependencies field, Bun may still resolve and fetch these packages, leading to different installed sets across machines even with an identical lockfile. Additionally, Bun does not provide a built‑in mechanism to block network access during installation, so postinstall scripts or binary downloads can contact external endpoints despite a frozen lockfile.

The Bun team has not yet decided whether to add a lockfile field or a CLI option to lock optional dependencies, leaving this behavior as an open design decision for achieving fully repeatable builds.

What approach should Bun take to ensure optional dependencies are also fixed by the lockfile?
Should a dedicated flag be introduced to skip optional dependency resolution when --frozen-lockfile is used?
Is there a way to enforce network isolation during install without relying on external tools?