Interesting, albeit a bit lightweight as compared to the similar document from 1Password: https://support.1password.com/cs/opvault-design/ (yes, I recognize it's a tiny bit apples-to-oranges since 1P has now gone whole hog toward their b2 API)

Speaking of which, I presume Huy doesn't work for Bitwarden, so it's unfortunate they needed some independent blogger to write up their auth scheme. I do realize there's an independent implementation in Vaultwarden, so that's almost better than a spec -- just as long as Vaultwarden was a clean-room impl and thus reading that code is "legally safe."