Convert a string to a Secret? (aws ecr password to docker Push secret) | Dagger | Page 1

So here's an annoyance. I'm using the aws cli.#Command to get the login password for my AWS ECR repository (dagger-cue). This works, and my #Plan command for getting that has

output: strings.TrimSpace(_cmd.result)

ok, fine. But later I try to docker.#Push with

auth: {
   username: "AWS"
   secret: ecr_password.output
}

Of course this fails, because docker.#Push authentication is

auth?: {
  username: string
  secret: dagger.#Secret
}

...and the result of the aws CLI #Command ends up being a string I think. But it's completely unclear to me how to convert between the two, and it's driving me a little mad. Any suggestions?

#Convert a string to a Secret? (aws ecr password to docker Push secret)