Source files

Hi, i recently made a website for someone and did not have them sign the contract.
The site is finished, and I have been paid. They are now requesting the source files.
This was never discussed before. I don’t want to give them away, but I want to be fair.
If I do give them away now, I would like them to sign a contract that limits their changes to the site and stating that they must leave my web design credit on the site since I designed and programmed it. Thoughts? Thanks!