I agree about not putting a time line on it and I'd also suggest not leaving the door open to future contact.
My husband is an addict and I've put up with the lying, stealing and manipulation too. He's been in and out of rehab. Does OK for a while and then relapses. It's painful. The whole process starts over. He knows that I'm typically a sucker for letting him back in.
Be firm. I'd opt for the "I have to process this" as suggested by Maia.