# detective-postcss

> Detective to find dependents of CSS (PostCSS dialect)

Latest version **9.0.1** (published 2026-07-01) · MIT license · 0 weekly downloads

## Install

```sh
npm install detective-postcss
pnpm add detective-postcss
yarn add detective-postcss
bun add detective-postcss
```

## Health

**Score 65/100 (B)** — status: active.

Positive: esm support; no vulnerabilities; has provenance; recently updated; high maintenance score.

Warnings: low downloads; no types.

## Facts

| | |
|---|---|
| Version | 9.0.1 |
| Published | 2026-07-01 |
| First published | 2018-04-12 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | none |
| Module format | ESM |
| Node | >=20.19.0 \|\| >=22.12.0 |
| Dependencies | 2 |
| Unpacked size | 10.3 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Provenance | attested (GitHub Actions) |
| GitHub stars | 7 |
| Author | Joscha Feth |
| Maintainers | joscha, xhmikosr |

## Links

- npm: https://www.npmjs.com/package/detective-postcss
- Repository: https://github.com/dependents/node-detective-postcss
- Homepage: https://github.com/dependents/node-detective-postcss#readme
- Issues: https://github.com/dependents/node-detective-postcss/issues
- npm.io page: https://npm.io/package/detective-postcss

## Dependencies (2)

- [is-url-superb](https://npm.io/package/is-url-superb.md) ^4.0.0
- [postcss-values-parser](https://npm.io/package/postcss-values-parser.md) ^6.0.2

## Recent versions

- 9.0.1 (latest) — 2026-07-01
- 9.0.0 — 2026-05-19
- 8.0.4 — 2026-05-19
- 8.0.3 — 2026-04-23
- 8.0.0 — 2026-04-23
- 7.0.1 — 2025-02-01
- 7.0.0 — 2024-04-08
- 6.1.3 — 2023-04-26
- 6.1.2 — 2023-04-18
- 6.1.1 — 2023-03-18
- 5.1.3 — 2022-12-04
- 6.1.0 — 2022-05-21
- 6.0.1 — 2022-03-18
- 5.1.1 — 2022-03-18
- 5.1.0 — 2022-03-14
- … 9 more at https://npm.io/package/detective-postcss/versions

## README

# node-detective-postcss

[![build](https://img.shields.io/github/actions/workflow/status/dependents/node-detective-postcss/node.js.yml?branch=main&label=CI&logo=github)](https://github.com/dependents/node-detective-postcss/actions/workflows/node.js.yml?query=branch%3Amain)
[![npm version](https://img.shields.io/npm/v/detective-postcss?logo=npm&logoColor=fff)](https://www.npmjs.com/package/detective-postcss)
[![npm downloads](https://img.shields.io/npm/dm/detective-postcss)](https://www.npmjs.com/package/detective-postcss)

> Find the dependencies of a CSS file (PostCSS dialect)

Supports `@import` and [`@value ... from`](https://github.com/css-modules/postcss-icss-values). Absolute and protocol-relative URLs are automatically filtered out.

The AST is generated using [postcss](https://github.com/postcss/postcss) and [postcss-values-parser](https://github.com/shellscape/postcss-values-parser).

## Installation

```sh
npm install detective-postcss
```

`postcss` must be installed separately as a peer dependency:

```sh
npm install postcss
```

## Usage

```js
// ESM
import { readFileSync } from 'node:fs';
import detective from 'detective-postcss';
// CommonJS
const { readFileSync } = require('node:fs');
const detective = require('detective-postcss');

const content = readFileSync('styles.css', 'utf8');

// Returns an array of imported file paths (e.g. ['foo.css', 'bar.css'])
const dependencies = detective(content);

// Also include url() references (images, fonts, etc.) found in declarations
const allDependencies = detective(content, { url: true });
```

## API

### `detective(src, options?)`

| Parameter     | Type      | Required | Description                                                                                                                |
| ------------- | --------- | -------- | -------------------------------------------------------------------------------------------------------------------------- |
| `src`         | `string`  | Yes      | CSS source code to analyse                                                                                                 |
| `options.url` | `boolean` | No       | When `true`, also extracts `url()` references from declarations (e.g. `background`, `src`, `cursor`). Defaults to `false`. |

Returns `string[]` - the list of local dependency paths found in the source.

Throws `detective.MalformedCssError` if `src` cannot be parsed.

#### What is detected

| Syntax                     | Example                            | Detected by default       |
| -------------------------- | ---------------------------------- | ------------------------- |
| `@import "file.css"`       | `@import "theme.css"`              | yes                       |
| `@import url(file.css)`    | `@import url(print.css)`           | yes                       |
| `@value x from "file.css"` | `@value primary from 'colors.css'` | yes                       |
| `url()` in declarations    | `background: url(bg.png)`          | only with `{ url: true }` |

Absolute URLs (`https://...`) and protocol-relative URLs (`//...`) are always ignored.

## Related

This is the CSS (PostCSS dialect) counterpart to:

- [detective-cjs](https://github.com/dependents/node-detective-cjs) - CommonJS
- [detective-amd](https://github.com/dependents/node-detective-amd) - AMD
- [detective-es6](https://github.com/dependents/node-detective-es6) - ES modules
- [detective-sass](https://github.com/dependents/node-detective-sass) - Sass
- [detective-scss](https://github.com/dependents/node-detective-scss) - SCSS

## Releasing

1. Ensure CI is green on `main`.
2. Preview what would be included in the package without publishing: `npm pack --dry-run`.
3. Bump the version following [semver](https://semver.org/) (this also creates the `vX.Y.Z` tag): `npm version <patch|minor|major>`.
4. Push the commit and tag: `git push --follow-tags`.
5. Create (or draft) a GitHub release from that `vX.Y.Z` tag, then **Publish** it.
6. Publishing the release triggers [npm-publish](https://github.com/dependents/node-detective-postcss/actions/workflows/npm-publish.yml) (`release.published`), which runs `npm ci` and `npm publish --provenance`.

## License

[MIT](LICENSE)

---
_Source: https://npm.io/package/detective-postcss · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._
