Deploying firebase cloud fails because of some build errors

I just created a new Firebase project and copy-pasted the sample functions (v1) from firebase docs. When trying to deploy these functions with firebase deploy --only functions it throws the following error message:

Gen1 operation for function projects/xxx/locations/us-central1/functions/addMessage failed: Build failed: Build error details not available.Please check the logs at https://console.cloud.google.com/cloud-build/builds;region=us-central1/xxx. Please visit https://cloud.google.com/functions/docs/troubleshooting#build for in-depth troubleshooting documentation for build related errors..
Gen1 operation for function projects/xxx/locations/us-central1/functions/makeUppercase failed: Build failed: Build error details not available.Please check the logs at https://console.cloud.google.com/cloud-build/builds;region=us-central1/xxx. Please visit https://cloud.google.com/functions/docs/troubleshooting#build for in-depth troubleshooting documentation for build related errors..

Functions deploy had errors with the following functions:
        addMessage(us-central1)
        makeUppercase(us-central1)
i  functions: cleaning up build files...
⚠  functions: Unhandled error cleaning up build images. This could result in a small monthly bill if not corrected. You can attempt to delete these images by redeploying or you can delete them manually at
        https://console.cloud.google.com/gcr/images/xxx/eu/gcf
        https://console.cloud.google.com/gcr/images/xxx/us/gcf
Error: There was an error deploying functions:
- Error Failed to create function addMessage in region us-central1
- Error Failed to create function makeUppercase in region us-central1

The error message at the linked url is:

Step #2 - "build": ERROR: failed to create image cache: accessing cache image "us-central1-docker.pkg.dev/ki-beratung-8af95/gcf-artifacts/add_message/cache:latest": connect to repo store "us-central1-docker.pkg.dev/xxx/gcf-artifacts/add_message/cache:latest": GET https://us-central1-docker.pkg.dev/v2/token?scope=repository%3Axxx%2Fgcf-artifacts%2Fadd_message%2Fcache%3Apull&service=: DENIED: Permission "artifactregistry.repositories.downloadArtifacts" denied on resource "projects/xxx/locations/us-central1/repositories/gcf-artifacts" (or it may not exist)

In Logs, it looks like below:

This is supposed to be 'firebase cloud function'. Why does it involve cloud build, artifact registry, cloud logging, etc.? For years, this process just worked. Anybody knows what changed?

It turns out that I needed to add Artifact Registry Administrator role to my firebase service account under IAM.

After that a follow-up error happened that required me to change my organization policy under IAM/Organization-Policies regarding domain restricted sharing to be google-managed default instead of Inherit parent's policy.

I couldn't change that policy immediately because apparently I didn't have the permission to change the above policy. So I had to run the following command in cloud shell:

gcloud organizations add-iam-policy-binding YOUR_ORG_ID --member='user:YOUR_EMAIL' --role='roles/orgpolicy.policyAdmin'

After these two changes, I could deploy the function ✅

My guess is that the deployment process needs to assign a couple of additional permissions to itself, but it couldn't do it because of the restrictions.

Although my original question is hereby answered, I still don't understand why domain restricted sharing didn't start with google-managed default from the beginning :/