Estou com dificuldade de entender porque não é possível aplicar o delete user.password no código abaixo

Retorno do Terminal

The operand of a 'delete' operator must be optional.


<!-- begin snippet: js hide: false console: true babel: false -->

<!-- language: lang-js -->

    import { Request, Response } from 'express';
    import { getRepository } from 'typeorm';
    import bcrypt from 'bcryptjs';
    import jwt from 'jsonwebtoken';

    import User from '../models/User';



    class AuthController {
      async authenticate(req: Request, res: Response){
        const repository = getRepository(User);

        const { email, password } = req.body;

        const user = await repository.findOne({
          where: { email }
        });

        if(!user) {
          return res.sendStatus(401);
        }

        const isValidPassword = await bcrypt.compare(password, user.password);

        if(!isValidPassword) {
          return res.sendStatus(401);
        }
        
        const token = jwt.sign({ id: user.id}, 'secret', { expiresIn: '1d'});

        delete user.password;

        return res.json({
          user,
          token,
        });
      }
    }

    export default new AuthController();

<!-- end snippet -->