Required permissions for /accounts/<account_id>/email/routing/rules/plan (blocks email addresses deploy)

Question

What minimum API-token permissions authorize /accounts/<account_id>/email/routing/rules/plan?

I'm hitting Authentication error [code: 10000] on this call during wrangler deploy, with a build token that already grants all permissions the token UI exposes for Email Routing. Trying to figure out what's missing.

Context

wrangler.jsonc uses the top-level addresses field (Email Routing → "Send to a Worker"):

{
  "name": "<worker>",                                   
  "addresses": ["app1@example.com", "app2@example.com"] 
}                                                       

From the cloudflare/workers-sdk#14471 implementation, the addresses deploy step reads a plan and then applies via per-zone rule endpoints. The plan read is what fails for me:

✘ [ERROR] A request to the Cloudflare API
  (/accounts/<account_id>/email/routing/rules/plan) failed.
  Authentication error [code: 10000]

What works vs what doesn't

• ✅ wrangler deploy locally (with super-admin account)
• ❌ wrangler deploy from Workers Builds CI

Permissions of the API Token used in build

<account> (account scope) —
  Email Routing Addresses: Edit, Email Sending: Edit, ... 
All zones (zone scope) —
  Email Routing Rules: Edit, ... 

Environment

• wrangler 4.115.0, Workers Builds CI (non-interactive), bun@1.3.11 / nodejs@24.18.0.

Comienza con la implementación de addresses deploy mencionada en cloudflare/workers-sdk#14471 y con la solicitud fallida a /accounts/<account_id>/email/routing/rules/plan. Compara los permisos de los tokens de account y zone mostrados en el issue, y luego reproduce la diferencia entre el despliegue local como super-admin y Workers Builds CI. Se considera terminado cuando se haya identificado el permiso mínimo que autoriza el endpoint plan.