Polynomial-time integer factorization (Shor)

Suppose $p$ and $q$ are unknown distinct prime numbers. Let $N=pq$ be known and let $n=\lceil\log_2 N\rceil$. There exists a quantum algorithm that returns $d \in \{p, q\}$ with probability at least $1-\eta$, using $3n+\mathcal{O}(\log n)$ logical qubits, $\mathcal{O}(\log(1/\eta))\bigl(0.4n^3+0.0006n^3\log n\bigr)$ Toffoli gates, $\mathcal{O}(\log(1/\eta))\bigl(600n^2+n^2\log n\bigr)$ maximal circuit depth, and $\mathcal{O}(\operatorname{poly}(n,\log(1/\eta)))$ classical arithmetic operations.