/** Recovery codes contain exactly six ASCII digits. */
export function isValidOtp(value: string): boolean {
  return /^\d{6}$/.test(value);
}